CVE-2026-28381: Local File Read/Write to Potential Privilege Escalation via Snowflake GET/PUT

Synopsis

An authorization control bypass in the Grafana Snowflake datasource plugin (versions up to and including 1.14.12) allows any user who can run queries against the datasource to issue Snowflake GET and PUT commands. These commands reach the local Grafana server filesystem over the network, requiring only a low-privilege account. Successful exploitation lets an attacker read arbitrary files from the Grafana server or write files to it, which opens a path to privilege escalation on the host. HarborGuard is tracking this advisory and will make a patched-image rebuild available as soon as an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Grafana service over the network to submit queries against the Snowflake datasource (AV:N).

• AuthenticationRequired

  A valid Grafana account with datasource query access is needed, but any low-privilege user account is sufficient (PR:L).

• Victim interactionNot required

  No victim action is needed; the attacker submits the malicious GET or PUT command directly without relying on another user (UI:N).

• Attack complexityDetail

  The exploit is reliable and requires no special race conditions or environmental prerequisites; the attack succeeds consistently once the attacker has query access (AC:L).

Blast Radius

• Reads arbitrary files from the Grafana server filesystem, including configuration files, secrets, and credentials stored on disk.
• Writes attacker-controlled files to the Grafana server filesystem, enabling placement of webshells, backdoors, or overwriting of existing binaries and config files.
• File write access creates a concrete path to escalating privileges on the underlying host beyond the Grafana process boundary.