The Grafana Snowflake Datasource version 1.14.7 contains a vulnerability (CVE-2026-28381) that permits any user with access to the datasource to perform GET and PUT commands. This capability allows unauthorized reading and writing of files between the local Grafana server and the connected Snowflake host, violating access control (CWE-284). The vulnerability has a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N), indicating network attack vector, low attack complexity, requiring low privileges, no user interaction, and resulting in high confidentiality and integrity impact with no availability impact. The affected version is 1.14.7. The service is cloud-hosted, and the vendor manages remediation. No known exploits in the wild have been reported.

Successful exploitation allows an attacker with access to the Snowflake datasource to read and write files between the local Grafana server and the Snowflake host, leading to complete compromise of confidentiality and integrity of data accessible via the datasource. This can result in unauthorized data disclosure and unauthorized data modification. Availability is not impacted.

A patch is available for this vulnerability. Since the Grafana Snowflake Datasource is a cloud service, the vendor typically manages remediation server-side. Users should verify with the vendor advisory that the patch has been applied or that the service has been updated to mitigate this vulnerability. No additional user action is specified or required beyond ensuring the service is up to date.