# CVE-2026-81930: Apache Airflow Snowflake provider: Unvalidated account field redirects SQL API bearer token off-domain > Attackers can redirect SQL API bearer tokens to malicious hosts by manipulating unvalidated connection fields, leading to credential theft. - **Severity:** Medium 6.3 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 29 Sep 2026 - **Updated:** 29 Sep 2026 - **Also known as:** GHSA-x776-f7fc-mx6q, PYSEC-2026-4188 ## What is CVE-2026-81930? CVE-2026-81930 is a medium-severity server-side request forgery vulnerability in Apache Airflow Snowflake provider, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description Apache Airflow's Snowflake provider did not validate the connection's `account` and `region` fields before interpolating them into request URLs. The SQL API endpoint is built as `https://{account}.snowflakecomputing.com/api/v2/statements`, so an `account` value containing `/`, `?` or `#` demotes the intended domain to a path, query or fragment and leaves the attacker in control of the request host. The provider sends that request with an `Authorization: Bearer` header carrying a JWT minted from the connection's private key, or the configured OAuth or programmatic access token. A user who can edit the Snowflake connection but cannot read its secrets — Airflow gives connection-configuration users write-only access to stored credentials, and a `private_key_file` lives on the worker rather than in the connection — can therefore cause a valid token for the account to be delivered to a host of their choosing and replay it against the genuine Snowflake endpoint. No Dag-authoring ability is required: the attacker edits the connection and waits for an existing Dag to use it. The same unvalidated value was also used to build the OAuth token-request URL and the Cortex Agent base URL. Affects deployments where Snowflake connections are editable by users who are not trusted with the connection's credentials. Users are advised to upgrade to `apache-airflow-providers-snowflake` `6.18.0` or later, which rejects `account` and `region` values containing anything other than letters, digits, `.`, `_` and `-` in every URL the provider builds from them. Weakness: CWE-522 (Insufficiently Protected Credentials) ## Which versions are affected by CVE-2026-81930? 1 open source package ship an affected version, including apache-airflow-providers-snowflake. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `apache-airflow-providers-snowflake` | PyPI | All versions | 6.18.0 | Products: Apache Apache-Airflow-Providers-Snowflake. ## How do I fix CVE-2026-81930? Upgrade apache-airflow-providers-snowflake to 6.18.0 or later. ## Is CVE-2026-81930 being exploited? There is no known exploitation of CVE-2026-81930 in the wild and no public exploit code. ## Other vulnerabilities in Apache Airflow Snowflake provider - [CVE-2025-50213](https://insights.sbomify.com/CVE-2025-50213/): Apache Airflow Providers Snowflake: Potential SQL injection in CopyFromExternalStageToSnowflakeOperator (critical 9.8) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2026-81930 and fix it if it is affected. What it is: CVE-2026-81930 is a medium-severity server-side request forgery vulnerability in Apache Airflow Snowflake provider, published on 29 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: There is no known exploitation of CVE-2026-81930 in the wild and no public exploit code. Affected packages and fixed versions: - apache-airflow-providers-snowflake (PyPI): affected all versions; fixed in 6.18.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2026-81930/ (Markdown: https://insights.sbomify.com/CVE-2026-81930/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2026-81930 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-81930 - OSV: https://osv.dev/vulnerability/CVE-2026-81930 --- From sbomify Insights: https://insights.sbomify.com/CVE-2026-81930/ Summaries are generated and may contain mistakes; the official description above is the record.