PT-2025-46531 · Grafana · Grafana Snowflake Datasource Plugin

Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-3717

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Grafana Snowflake Datasource Plugin versions 1.5.0 through 1.14.0

Description The Grafana Snowflake Datasource Plugin contains a flaw where, with Oauth passthrough enabled, concurrent use by multiple users on a single Grafana instance can lead to the incorrect user identifier being used. This can result in unauthorized information disclosure, as users may access data they are not permitted to view.

Recommendations Update to a version later than 1.14.0.

Fix

Weakness Enumeration

CWE-653

Related Identifiers

BDU:2026-00240

CVE-2025-3717

Affected Products

Grafana Snowflake Datasource Plugin

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-3717 · Security Note
• https://bdu.fstec.ru/vul/2026-00240 · Security Note
• https://twitter.com/CVEnew/status/1988348973166293016 · Twitter Post
• https://t.me/CVEtracker/37082 · Telegram Post
• https://grafana.com/security/security-advisories/cve-2025-3717 · Note