Snowflake Postgres role chain reached OS command execution, now fixed
Original title: Researchers Hack Snowflake PostgreSQL Database to Gain Full Server-Level Code Execution
Varonis chained CREATEROLE, pg_cron, and archive_command in its own test tenant; Snowflake patched before publication.
Varonis Threat Labs showed that a non-superuser snowflake_admin role with CREATEROLE on Snowflake-managed PostgreSQL could reach operating-system command execution as the postgres system account. The chain granted pg_read_all_data and pg_write_all_data, altered a pg_cron job to create a SECURITY DEFINER function, restored blocked file functions through PostgreSQL’s internal language, and set archive_command. Snowflake fixed the issue server-side before publication, and the report says no customer data was accessed.
Unconfirmed: The report does not say whether anyone outside the researchers’ single-tenant test environment used the chain.
- Researchers first reported the chain on May 31, 2026, and published it on October 17.
- Snowflake acknowledged the report on June 1 and confirmed the boundary cross on June 9.
- The starting account was snowflake_admin; CREATEROLE alone was not full database control.
- Snowflake customers using Snowflake Postgres do not need extra action for this finding.
- Self-hosted PostgreSQL operators are advised to limit CREATEROLE, pg_cron, and C-language functions.
Impact: OS command execution as the postgres system account
| Product | Affected | Fixed in |
|---|---|---|
| Snowflake Postgres | — | fixed server-side before publication |
- 1.Snowflake Postgres customers need no additional action for this finding.
- 2.On self-hosted PostgreSQL, remove CREATEROLE from application accounts unless required.
- 3.Review pg_cron jobs, SECURITY DEFINER functions, and who can create C-language functions.
- Vendors
- Snowflake
- Products
- Snowflake PostgresPostgreSQL
- Organizations
- Varonis Threat Labs
From the original article
4 min read at gbhackers.com
A security test of Snowflake-managed PostgreSQL has shown how a database role with limited privileges could be turned into control of the server running the database. Researchers chained several built-in PostgreSQL features to reach operating-system command execution, even though Snowflake had blocked common ways to run commands and access files through SQL. The finding highlights […]
By Tushar Subhra · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.