CVE-2026-81930: Apache Airflow Snowflake Provider URL Injection Vulnerability
Summary
CVE-2026-81930: Apache Airflow's Snowflake provider did not validate the connection's account and region fields before interpolating them into request URLs. Affects apache-airflow-providers-snowflake versions < 6.18.0. Fixed in 6.18.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Airflow is an open-source platform designed to programmatically author, schedule, and monitor workflows. The Snowflake provider allows users to connect to Snowflake, a cloud-based data warehousing service, enabling seamless data integration and processing. However, a critical vulnerability exists in the way the Snowflake provider handles connection parameters, specifically the account and region fields.
Vulnerability Detail
The vulnerability arises from the lack of validation for the account and region fields in the Snowflake connection configuration. This oversight allows an attacker to inject malicious values into the request URLs, potentially redirecting requests to an unauthorized host. The SQL API endpoint is constructed using these fields, and if an attacker can edit the connection, they can manipulate the request to deliver a valid JWT token to a host of their choosing. This could lead to unauthorized access to sensitive data and resources without needing to author a DAG.
How To Fix
Latest published version: 6.19.0 as of 23 Oct 2026
pip install --upgrade "apache-airflow-providers-snowflake==6.19.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.18.0
This is the first release that contains the fix.
pip install --upgrade "apache-airflow-providers-snowflake==6.18.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, restrict access to the Snowflake connection configuration to trusted users only. This can help mitigate the risk until the package is updated to a secure version.
Conclusion
The CVE-2026-81930 vulnerability in the Apache Airflow Snowflake provider poses a significant risk due to improper validation of connection parameters. Users are strongly advised to upgrade to version 6.18.0 or later to mitigate this risk. Additionally, restricting access to connection configurations can serve as a temporary measure until the upgrade is completed.
See every vulnerability recorded for apache-airflow-providers-snowflake →
FAQ
CVE-2026-81930 is a vulnerability in the Apache Airflow Snowflake provider that allows for URL injection due to improper validation of connection parameters.
If exploited, this vulnerability could allow an attacker to redirect requests and gain unauthorized access to sensitive data by manipulating the connection parameters.
If an immediate upgrade is not possible, restrict access to the Snowflake connection configuration to trusted users to minimize risk.
Vulert monitors and alerts in real-time for open-source vulnerabilities using just the Pipfile.lock, allowing users to stay informed about potential risks.
Yes, you can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring a signup.
Related vulnerabilities
Recent vulnerabilities recorded for apache-airflow-providers-snowflake.
