AZL-112747: CVE-2026-114456 affecting package influxdb 2.7.5-23

Q: Under what circumstances could an attacker exploit this issue?

An attacker would need to reach the local loopback callback listener while a user is actively performing an external-browser single sign-on login. The issue concerns drivers using authenticator=externalbrowser and relies on the listener accepting a forged token-bearing callback before the legitimate response.

Q: What is the likely impact of a successful attack?

A forged callback response could cause the user's authentication attempt to fail. The provided information does not describe account takeover or successful authentication as the attacker.

Q: Which component versions contain the available fixes?

Fixes are available in Snowflake Connector for Python 4.8.0, Go Driver v2.3.0, JDBC Driver 4.4.0, Node.js Driver 3.4.0, .NET Connector 6.3.0, ODBC Driver 4.0.0, PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. JDBC 4.4.0 also covers the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts; Go v1 users must migrate to the latest major module version.

Q: What should teams do to remediate this issue?

Manually upgrade the affected Snowflake client driver to a version containing the fix. For the Go driver, deployments using v1 must migrate to the latest major module version.

Published Nov 4, 2026

Updated

Multiple Snowflake client drivers implementing the authenticator=externalbrowser single sign-on flow could have allowed an attacker to interfere with a user's login attempt through weaknesses in the local loopback callback listener used to receive the identity provider's response. The listener reflected an arbitrary request's Origin header into its CORS response headers and accepted the first token-bearing request it received during the login window without verifying a CSRF state value bound to that specific login attempt. An attacker able to reach the listener during an active login might have leveraged this to submit a forged callback response, causing the authentication attempt to fail. The fix is available in Snowflake Connector for Python 4.8.0, Snowflake Go Driver v2.3.0, Snowflake JDBC Driver 4.4.0 (including the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts), Snowflake Node.js Driver 3.4.0, Snowflake Connector for .NET 6.3.0, Snowflake ODBC Driver 4.0.0, Snowflake PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. Go v1 users must migrate to the latest major version of the module. Users must manually upgrade.

Affected Software

1 affected component

azure-linux/influxdb<=2.7.5-23

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Snowflake Connector for Python to a version that resolves this vulnerability.
Fixed in 4.8.0
Upgrade
Upgrade Snowflake Go Driver to a version that resolves this vulnerability.
Fixed in 2.3.0
Upgrade
Upgrade Snowflake JDBC Driver to a version that resolves this vulnerability.
Fixed in 4.4.0
Upgrade
Upgrade snowflake-jdbc-fips to a version that resolves this vulnerability.
Fixed in 4.4.0
Upgrade
Upgrade snowflake-jdbc-thin to a version that resolves this vulnerability.
Fixed in 4.4.0
Upgrade
Upgrade Snowflake Node.js Driver to a version that resolves this vulnerability.
Fixed in 3.4.0
Upgrade
Upgrade Snowflake Connector for .NET to a version that resolves this vulnerability.
Fixed in 6.3.0
Upgrade
Upgrade Snowflake ODBC Driver to a version that resolves this vulnerability.
Fixed in 4.0.0
Upgrade
Upgrade Snowflake PHP PDO Driver to a version that resolves this vulnerability.
Fixed in 4.3.0
Upgrade
Upgrade libsnowflakeclient to a version that resolves this vulnerability.
Fixed in 2.11.1

Event History

Nov 4, 2026

Advisory Published

via OSV·12:17 PM

Data Sourced

via OSV·12:17 PM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-114456

Frequently Asked Questions

Under what circumstances could an attacker exploit this issue?

An attacker would need to reach the local loopback callback listener while a user is actively performing an external-browser single sign-on login. The issue concerns drivers using authenticator=externalbrowser and relies on the listener accepting a forged token-bearing callback before the legitimate response.

What is the likely impact of a successful attack?

A forged callback response could cause the user's authentication attempt to fail. The provided information does not describe account takeover or successful authentication as the attacker.

Which component versions contain the available fixes?

Fixes are available in Snowflake Connector for Python 4.8.0, Go Driver v2.3.0, JDBC Driver 4.4.0, Node.js Driver 3.4.0, .NET Connector 6.3.0, ODBC Driver 4.0.0, PHP PDO Driver 4.3.0, and libsnowflakeclient 2.11.1. JDBC 4.4.0 also covers the snowflake-jdbc-fips and snowflake-jdbc-thin artifacts; Go v1 users must migrate to the latest major module version.

What should teams do to remediate this issue?

Manually upgrade the affected Snowflake client driver to a version containing the fix. For the Go driver, deployments using v1 must migrate to the latest major module version.

AZL-112747: CVE-2026-114456 affecting package influxdb 2.7.5-23

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Under what circumstances could an attacker exploit this issue?

What is the likely impact of a successful attack?

Which component versions contain the available fixes?

What should teams do to remediate this issue?

Company

Resources

Contact

Frequently Asked Questions

Under what circumstances could an attacker exploit this issue?

What is the likely impact of a successful attack?

Which component versions contain the available fixes?

What should teams do to remediate this issue?