Snowflake Connector for Python improperly verifies TLS hostnames

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this b...

dbcat (0.3.1), pipelinewise-target-snowflake (1.11.0) +1 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.3.10)

snowflake-connector-python PYPI version 2.3.10 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbcat 0.3.1 - pipelinewise-target-snowflake 1.11.0 - pydbconnector-jinghan-ma =0.0.4, =0.0.5 Source cves:...

pipelinewise-target-snowflake (1.12.0) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.4.2)

snowflake-connector-python PYPI version 2.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-target-snowflake 1.12.0 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...

ewah (>=0.1.25, <=0.2.5), fivetran-autogen (>=0.0.1rc8, <=0.0.1rc9) +6 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.0.2)

snowflake-connector-python PYPI version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - ewah =0.1.25, =0.0.1rc8, =0.0.2, =2.2.0, =0.14.1, =0.110.1, =2.0.0, =2.1.0 - spswarehouse-airflow 0.6.3 Sour...

pipelinewise-tap-snowflake (>=1.1.1, <=2.0.0) potentially affected by CVE-2026-15925 via snowflake-connector-python (2.2.2)

snowflake-connector-python PYPI version 2.2.2 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - pipelinewise-tap-snowflake =1.1.1, =2.0.0 Source cves: CVE-2026-15925 Source advisory: OSV:PYSEC-2026-3920...

dbt (>=0.20.0b1, <=0.20.2), dbt-osmosis (>=0.2.0, <=0.2.1) +5 more potentially affected by CVE-2026-15925 via snowflake-connector-python (2.4.6)

snowflake-connector-python PYPI version 2.4.6 is affected by a known vulnerability. The following packages have a transitive dependency on snowflake-connector-python and may be impacted: - dbt =0.20.0b1, =0.2.0, =0.20.0b1, =1.13.0, =0.2.0a0, =2.9.1, =0.0.2a1, =0.0.2rc4 Source cves: CVE-2026-15925...

Insufficiently Protected Credentials

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insufficiently Protected Credentials in the WORKLOADIDENTITY authenticator through AuthByWorkloadIdentity.prepare in src/snowflake/connector/auth/workloadidentity.py. An...

CVE-2026-86600

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

CVE-2026-86600

Snowflake drivers (PHP PDO, .NET, Go, Python, ODBC, libsnowflakeclient, JDBC, Node.js) are affected by a flaw in WORKLOAD_IDENTITY authentication: the driver mints a cloud workload-identity token and attaches it to the login request without verifying the configured host is a Snowflake endpoint . ...

CVE-2026-86600 Workload identity attestation generated before login host validation in Snowflake drivers

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

EUVD-2026-72877

In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a...

GHSA-5CWM-P7PJ-GQP2 Duplicate Advisory: Sensitive information written to logs by Snowflake drivers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drive...

Duplicate Advisory: Sensitive information written to logs by Snowflake drivers

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-qqj6-54q6-cxv6. This link is maintained to preserve external references. Original Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drive...

CVE-2026-86597

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

ae-mcp (0.2.0), aigc-evals (>=0.0.2, <=0.0.3) +38 more potentially affected by CVE-2026-86597 via snowflake-connector-python (>=4.0.0, <=4.7.2)

snowflake-connector-python PYPI version =4.0.0, =0.0.2, =0.1.0, =2020.5.20rc1, =1.0.0b2, =0.185.0, =1.0.3, =1.0.0, =0.0.1a66, =0.1.0, =0.42.1, =1.10.7, =2.79.1a0, =2.86.2 and more Source cves: CVE-2026-86597 Source advisory: SNYK:PYTHON-SNOWFLAKECONNECTORPYTHON-19666491...

Insertion of Sensitive Information into Log File

Overview snowflake-connector-python is a Snowflake Connector for Python Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the logging process. An attacker can obtain authentication tokens, encryption keys, pre-signed URLs, and SAML assertions...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...

CVE-2026-86597 Sensitive information written to logs by Snowflake drivers

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the...