Sensitive information written to logs by Snowflake drivers
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.
Summary
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Snowflake | Snowflake Connector for Python | before 4.7.3 | 4.7.3 | Patch available | CNA |
| Snowflake | Snowflake Go Driver | up to 1.19.1 | — | No fix listed | CNA |
| Snowflake | Snowflake Go Driver | 2.0.0 to before 2.2.0 | 2.2.0 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver | before 4.3.4 | 4.3.4 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver (FIPS) | before 4.3.4 | 4.3.4 | Patch available | CNA |
| Snowflake | Snowflake JDBC Driver (Thin) | before 4.3.4 | 4.3.4 | Patch available | CNA |
| Snowflake | Snowflake Node.js Driver | before 3.3.0 | 3.3.0 | Patch available | CNA |
| Snowflake | Snowflake PHP PDO Driver | 3.4.0 to before 4.2.0 | 4.2.0 | Patch available | CNA |
| Snowflake | Snowflake ODBC Driver | 3.16.0 to before 3.20.0 | 3.20.0 | Patch available | CNA |
| — | snowflake-sdk (npm) | before 3.3.0 | 3.3.0 | Patch available | GHSA-qqj6-54q6-cxv6 |
| — | snowflake-connector-python (PyPI) | before 4.7.3 | 4.7.3 | Patch available | GHSA-qqj6-54q6-cxv6 |
| — | github.com/snowflakedb/gosnowflake (Go) | up to 1.19.1 | — | No fix listed | GHSA-qqj6-54q6-cxv6 |
| — | net.snowflake:snowflake-jdbc (Maven) | before 4.3.4 | 4.3.4 | Patch available | GHSA-qqj6-54q6-cxv6 |
| — | net.snowflake:snowflake-jdbc-thin (Maven) | before 4.3.4 | 4.3.4 | Patch available | GHSA-qqj6-54q6-cxv6 |
| — | net.snowflake:snowflake-jdbc-fips (Maven) | before 4.3.4 | 4.3.4 | Patch available | GHSA-qqj6-54q6-cxv6 |
| — | github.com/snowflakedb/gosnowflake/v2 (Go) | before 2.2.0 | 2.2.0 | Patch available | GHSA-qqj6-54q6-cxv6 |
- Snowflake Connector for Python VendorSnowflake Affected before 4.7.3 Fixed in 4.7.3 Patch available CNA
- Snowflake Go Driver VendorSnowflake Affected up to 1.19.1 Fixed in — No fix listed CNA
- Snowflake Go Driver VendorSnowflake Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
- Snowflake JDBC Driver VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
- Snowflake JDBC Driver (FIPS) VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
- Snowflake JDBC Driver (Thin) VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
- Snowflake Node.js Driver VendorSnowflake Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA
- Snowflake PHP PDO Driver VendorSnowflake Affected 3.4.0 to before 4.2.0 Fixed in 4.2.0 Patch available CNA
- Snowflake ODBC Driver VendorSnowflake Affected 3.16.0 to before 3.20.0 Fixed in 3.20.0 Patch available CNA
- snowflake-sdk (npm) Vendor— Affected before 3.3.0 Fixed in 3.3.0 Patch available GHSA-qqj6-54q6-cxv6
- snowflake-connector-python (PyPI) Vendor— Affected before 4.7.3 Fixed in 4.7.3 Patch available GHSA-qqj6-54q6-cxv6
- github.com/snowflakedb/gosnowflake (Go) Vendor— Affected up to 1.19.1 Fixed in — No fix listed GHSA-qqj6-54q6-cxv6
- net.snowflake:snowflake-jdbc (Maven) Vendor— Affected before 4.3.4 Fixed in 4.3.4 Patch available GHSA-qqj6-54q6-cxv6
- net.snowflake:snowflake-jdbc-thin (Maven) Vendor— Affected before 4.3.4 Fixed in 4.3.4 Patch available GHSA-qqj6-54q6-cxv6
- net.snowflake:snowflake-jdbc-fips (Maven) Vendor— Affected before 4.3.4 Fixed in 4.3.4 Patch available GHSA-qqj6-54q6-cxv6
- github.com/snowflakedb/gosnowflake/v2 (Go) Vendor— Affected before 2.2.0 Fixed in 2.2.0 Patch available GHSA-qqj6-54q6-cxv6
Remediation
- Fix · CNA Snowflake Connector for Python (Snowflake) Fixed in 4.7.3
- Fix · CNA Snowflake Go Driver (Snowflake) Fixed in 2.2.0
- Fix · CNA Snowflake JDBC Driver (Snowflake) Fixed in 4.3.4
- Fix · CNA Snowflake JDBC Driver (FIPS) (Snowflake) Fixed in 4.3.4
- Fix · CNA Snowflake JDBC Driver (Thin) (Snowflake) Fixed in 4.3.4
- Fix · CNA Snowflake Node.js Driver (Snowflake) Fixed in 3.3.0
- Fix · CNA Snowflake PHP PDO Driver (Snowflake) Fixed in 4.2.0
- Fix · CNA Snowflake ODBC Driver (Snowflake) Fixed in 3.20.0
- Fix · GHSA-qqj6-54q6-cxv6 snowflake-sdk (npm) Fixed in 3.3.0 Advisory →
- Fix · GHSA-qqj6-54q6-cxv6 snowflake-connector-python (PyPI) Fixed in 4.7.3 Advisory →
- Fix · GHSA-qqj6-54q6-cxv6 net.snowflake:snowflake-jdbc (Maven) Fixed in 4.3.4 Advisory →
- Fix · GHSA-qqj6-54q6-cxv6 net.snowflake:snowflake-jdbc-thin (Maven) Fixed in 4.3.4 Advisory →
- Fix · GHSA-qqj6-54q6-cxv6 net.snowflake:snowflake-jdbc-fips (Maven) Fixed in 4.3.4 Advisory →
- Fix · GHSA-qqj6-54q6-cxv6 github.com/snowflakedb/gosnowflake/v2 (Go) Fixed in 2.2.0 Advisory →
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Release ·
Snowflake Connector for Python, Snowflake Go Driver and 6 more products 2.2.0, 3.20.0 and 4 more versions
2 records Highest priority Priority LOW 2 LOW
Other records, highest priority first
- TI-2026-59237 Workload identity attestation generated before login host validation in Snowflake driversPriority LOW 38
Timeline
- 2026-10-02 Threatist record created from CVE-2026-86597
- 2026-10-03 Alias added: GHSA-5cwm-p7pj-gqp2
- 2026-10-06 Alias added: GHSA-qqj6-54q6-cxv6
- 2026-10-06 Fix available: Go/github.com/snowflakedb/gosnowflake/[email protected], Maven/net.snowflake:[email protected], Maven/net.snowflake:[email protected] +3 · GHSA-qqj6-54q6-cxv6
- 2026-10-06 CVSS score added · GHSA-qqj6-54q6-cxv6
- 2026-10-06 Weakness changed · GHSA-qqj6-54q6-cxv6
- 2026-10-06 9 new references · GHSA-qqj6-54q6-cxv6
References
Other 8
- Snowflake Connector for Python Release Notes
- Snowflake Go Driver Release Notes
- Snowflake JDBC Driver Release Notes
- Snowflake Node.js Driver Release Notes
- Snowflake PHP PDO Driver Release Notes
- Snowflake ODBC Driver Release Notes
- https://github.com/snowflakedb/snowflake-connector-nodejs/security/advisories/GHSA-qqj6-54q6-cxv6
- https://github.com/snowflakedb/snowflake-connector-nodejs
More Snowflake vulnerabilities
- TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
- TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
- TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
- TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
- TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
- TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
Sources
- CVE-2026-86597 · CVE Program
- CVE-2026-86597 · NVD
- FIRST EPSS
- GHSA-5cwm-p7pj-gqp2 · GitHub Advisory Database · CC BY 4.0
- GHSA-qqj6-54q6-cxv6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences