TI-2026-58682 Aliases CVE-2026-85528 GHSA-cjvw-xm5r-xgpf

Snowflake JDBC Driver auto-configuration account validation permits credential redirection

LOW 24CWE-20Published 2026-09-04 · Updated 2026-09-10

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0029 21st percentileScored 2026-11-07

Fix Fixed Snowflake JDBC Driver (Snowflake): 4.3.4Snowflake JDBC Driver (FIPS) (Snowflake): 4.3.4+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Snowflake	Snowflake JDBC Driver	4.2.0 to before 4.3.4	4.3.4	Patch available	CNA
Snowflake	Snowflake JDBC Driver (FIPS)	4.2.0 to before 4.3.4	4.3.4	Patch available	CNA
Snowflake	Snowflake JDBC Driver (Thin)	4.2.0 to before 4.3.4	4.3.4	Patch available	CNA

Snowflake JDBC Driver VendorSnowflake Affected 4.2.0 to before 4.3.4 Fixed in 4.3.4 Patch available CNA
Snowflake JDBC Driver (FIPS) VendorSnowflake Affected 4.2.0 to before 4.3.4 Fixed in 4.3.4 Patch available CNA
Snowflake JDBC Driver (Thin) VendorSnowflake Affected 4.2.0 to before 4.3.4 Fixed in 4.3.4 Patch available CNA

Remediation

Fix · CNA Snowflake JDBC Driver (Snowflake) Fixed in 4.3.4
Fix · CNA Snowflake JDBC Driver (FIPS) (Snowflake) Fixed in 4.3.4
Fix · CNA Snowflake JDBC Driver (Thin) (Snowflake) Fixed in 4.3.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2026-09-04
Snowflake JDBC Driver, Snowflake JDBC Driver (FIPS), Snowflake JDBC Driver (Thin) 4.3.4
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-58680 Improper OCSP response validation in Snowflake driversPriority LOW 34
Show all 2 records →

Timeline

2026-10-02 Threatist record created from CVE-2026-85528
2026-10-03 Alias added: GHSA-cjvw-xm5r-xgpf

References

Other 1

Snowflake JDBC Driver Release Notes

TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8

See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences