Varonis finds RCE chain in Snowflake-managed PostgreSQL

Varonis Threat Labs uncovered a remote code execution chain in Snowflake-managed PostgreSQL that lets a non-superuser role gain OS-level command execution by chaining five legitimate PostgreSQL features. Snowflake remediated the issue server-side, and customers need take no action.

• The chain starts from the snowflake_admin role with CREATEROLE
• pg_cron and LANGUAGE internal escalate the attacker to superuser
• Writing to archive_command yields OS command execution as postgres
• Snowflake fixed the issue server-side; no customer action needed