Sensitive Data Leakage

Snowflake drivers are vulnerable to Insertion of Sensitive Data Leakage. The vulnerability is due to sensitive data such as authentication tokens, encryption keys, pre-signed cloud-storage URLs, and SAML assertions being written to diagnostic logs, which allows an attacker with read access to the...

EUVD-2026-72672

Snowflake drivers writes sensitive information to logs...

NPM: Snowflake drivers writes sensitive information to logs

NPM: Snowflake drivers writes sensitive information to logs vulnerability discovered by ? in WordPress Npm snowflake-sdk versions 3.3.0...

Improper Certificate Validation

Snowflake drivers are vulnerable to Improper Certificate Validation. The vulnerability is due to improper validation of OCSP responses and treating definitive verification failures as transient, which allows a man-in-the-middle attacker with a revoked certificate and its private key to establish ...

CVE-2026-86600

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

EUVD-2026-72877

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600

Snowflake drivers (PHP PDO, .NET, Go, Python, ODBC, libsnowflakeclient, JDBC, Node.js) are affected by a flaw in WORKLOAD_IDENTITY authentication: the driver mints a cloud workload-identity token and attaches it to the login request without verifying the configured host is a Snowflake endpoint . ...

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-86597

Snowflake 's Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers write sensitive data—including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions —to diagnostic logs in paths where available log redaction did not cover all data types. An atta...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

PT-2026-87137

In affected Snowflake drivers, WORKLOAD IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600: Insufficiently Protected Credentials

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

PT-2026-87017

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.3 Snowflake Go Driver versions prior to 2.2.0 Snowflake JDBC Driver versions prior to 4.3.4 Snowflake Node.js Driver versions prior to 3.3.0 Snowflake PHP PDO Driver versions prior to 4.2.0...

SUSE CVE-2026-85525

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A...

CVE-2026-85525

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A...