CVE-2025-46326: Snowflake Connector TOCTOU Race Condition

CVE-2025-46326 Overview

The Snowflake Connector for .NET contains a Time-of-Check to Time-of-Use (TOCTOU) race condition in its Easy Logging feature on Linux and macOS. Versions from 2.1.2 to before 4.4.1 verify that the logging configuration file is writable only by its owner, but the check is racy and does not confirm the file owner matches the user running the Connector. A local attacker with write access to the configuration file or its parent directory can overwrite the configuration and control logging level and output location. The issue is fixed in version 4.4.1.

Critical Impact
A local attacker can hijack Easy Logging configuration to redirect log output and manipulate logging behavior, potentially exposing sensitive data written to attacker-controlled paths.

Affected Products

Snowflake Connector for .NET versions 2.1.2 through 4.4.0
Deployments on Linux operating systems
Deployments on macOS operating systems

Discovery Timeline

2025-04-28 - CVE-2025-46326 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-46326

Vulnerability Analysis

The flaw is a classic TOCTOU race condition [CWE-367] in the Easy Logging configuration loader. When Easy Logging is enabled, the Connector reads a user-provided configuration file that specifies logging level and output location. On Linux and macOS, the Connector inspects the file's permissions to confirm only the owner can write to it before parsing it.

Two defects exist in this validation. First, the permission check and the subsequent file read are not atomic, which creates a window where the file can be swapped or modified. Second, the check does not compare the file owner against the user identity running the Connector, so a file owned by a different local account may still pass validation.

The combined result allows a local attacker with write access to the configuration file or its containing directory to substitute an attacker-controlled configuration between the check and the read. The Connector then honors that configuration, which controls logging verbosity and the destination path where log data is written.

Root Cause

The permission-validation logic in EasyLoggingConfigFinder.cs and EasyLoggingConfigParser.cs performed non-atomic checks against the configuration file and omitted an owner-identity match against the effective user. This left a race window that a co-resident local attacker could exploit.

Attack Vector

Exploitation requires local access with write privileges to the Easy Logging configuration file or its parent directory. The attacker replaces or modifies the configuration between the Connector's permission check and its read of the file contents. Successful exploitation grants control over logging destination, which can be redirected to attacker-writable paths or used to influence application behavior that consumes log output.

text

// Patch excerpt: Snowflake.Data/Configuration/EasyLoggingConfigFinder.cs
 using System;
 using System.IO;
-using System.Runtime.InteropServices;
-using Mono.Unix;
 using Snowflake.Data.Core.Tools;
 using Snowflake.Data.Log;

Source: snowflake-connector-net commit 393aad3

text

// Patch excerpt: Snowflake.Data/Configuration/EasyLoggingConfigParser.cs
 using System;
 using System.Collections.Generic;
-using System.IO;
 using System.Linq;
 using System.Reflection;
+using Mono.Unix;
+using System.Security;
 using Newtonsoft.Json;
 using Newtonsoft.Json.Linq;
+using Snowflake.Data.Core.Tools;
 using Snowflake.Data.Log;

Source: snowflake-connector-net commit 393aad3. The patch relocates file-permission and ownership handling into a centralized helper and enforces owner-identity validation using Mono.Unix primitives.

Detection Methods for CVE-2025-46326

Indicators of Compromise

Modification of the Easy Logging configuration file (sf_client_config.json or the configured path) by a user other than the account running the Connector.
Log output written to unexpected directories, world-writable paths, or symlinked locations.
Presence of the Snowflake Connector for .NET at versions 2.1.2 through 4.4.0 on Linux or macOS hosts.

Detection Strategies

Inventory .NET applications and containers that reference the snowflake-connector-net package and identify versions below 4.4.1.
Audit filesystem ACLs on the Easy Logging configuration file and its parent directory to confirm ownership matches the runtime user.
Monitor for file replacement or rapid rename operations against the configuration path that could indicate a TOCTOU exploitation attempt.

Monitoring Recommendations

Enable filesystem auditing (auditd on Linux, EndpointSecurity on macOS) on the Easy Logging configuration path.
Alert on writes to the configuration directory from non-service accounts.
Track process launches of Connector-hosting applications alongside subsequent log file creation events to identify redirected output.

How to Mitigate CVE-2025-46326

Immediate Actions Required

Upgrade the Snowflake Connector for .NET to version 4.4.1 or later in all Linux and macOS deployments.
Restrict write access on the Easy Logging configuration file and its parent directory to the exact user account running the Connector.
Relocate the configuration file to a directory that only the runtime user can modify, avoiding shared or world-writable locations.

Patch Information

The issue is fixed in Snowflake Connector for .NET 4.4.1. Review the GitHub Security Advisory GHSA-c82r-c9f7-f5mj, the v4.4.1 release notes, and the remediation commit 393aad3.

Workarounds

Disable the Easy Logging feature until the Connector can be upgraded.
Store the configuration file in a directory owned by the Connector's runtime user with mode 0700, and ensure the file itself is mode 0600.
Run the Connector under a dedicated service account with no shared write access to the configuration path.

bash

# Restrict Easy Logging configuration permissions on Linux/macOS
sudo chown svc_snowflake:svc_snowflake /etc/snowflake/sf_client_config.json
sudo chmod 600 /etc/snowflake/sf_client_config.json
sudo chown svc_snowflake:svc_snowflake /etc/snowflake
sudo chmod 700 /etc/snowflake