CVE-2026-86597: Snowflake Drivers Information Disclosure

CVE-2026-86597 Overview

CVE-2026-86597 is an information disclosure vulnerability affecting multiple Snowflake client drivers, including the Python Connector, Go Driver, JDBC Driver, Node.js Driver, PHP PDO Driver, and ODBC Driver. The drivers wrote sensitive material to diagnostic logs where the built-in log redaction did not cover all affected paths and data types. Exposed data includes authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and Security Assertion Markup Language (SAML) assertions. An attacker with read access to the log destination can extract these secrets and authenticate to the corresponding Snowflake account or cloud-storage object while the credentials remain valid. The weakness is classified as [CWE-532] Insertion of Sensitive Information into Log File.

Critical Impact
Attackers with read access to driver diagnostic logs can obtain valid Snowflake authentication tokens, SAML assertions, and pre-signed cloud-storage URLs, enabling unauthorized access to Snowflake accounts and backing cloud storage objects.

Affected Products

Snowflake Connector for Python prior to v4.7.3
Snowflake Go Driver prior to v2.2.0, JDBC Driver prior to v4.3.4 (including snowflake-jdbc-fips and snowflake-jdbc-thin), and Node.js Driver prior to v3.3.0
Snowflake PHP PDO Driver prior to v4.2.0 and Snowflake ODBC Driver prior to v3.20.0

Discovery Timeline

2026-09-08 - CVE-2026-86597 published to the National Vulnerability Database (NVD)
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86597

Vulnerability Analysis

The affected Snowflake drivers emit diagnostic logs intended for troubleshooting client-side connection and query execution issues. The drivers include a log-redaction facility designed to strip credentials and other sensitive fields before writing log entries. That redaction did not cover every log path or every sensitive data type produced by the drivers.

As a result, authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions could be written in cleartext to diagnostic logs. These logs are commonly forwarded to shared destinations such as local filesystem paths, log aggregation services, and continuous integration/continuous deployment (CI/CD) artifact stores, expanding the population of principals that can read them.

Exploitation is bounded by two conditions. The attacker must have read access to the log destination, and the exposed credential or key must still be valid at the time of retrieval. Impact is further constrained by the scope of the leaked object, for example the permissions granted to a specific pre-signed URL or the account authorized by a leaked token.

Root Cause

The root cause is incomplete log redaction across the affected client drivers. Sensitive values reached diagnostic log sinks through code paths that the redaction layer did not intercept, resulting in cleartext persistence of secrets in a lower-trust storage tier.

Attack Vector

The attack vector is local to the log destination. An attacker with read access to a filesystem log directory, a log aggregation platform, or a CI/CD artifact store parses driver diagnostic logs for tokens, encryption keys, pre-signed URLs, or SAML assertions. The attacker then replays the extracted credential against the Snowflake API or the referenced cloud-storage object.

No verified public exploit code is available. See the vendor release notes referenced below for driver-specific details.

Detection Methods for CVE-2026-86597

Indicators of Compromise

Presence of authentication tokens, Authorization headers, SAML assertions, or pre-signed URLs containing X-Amz-Signature, sig=, or sv= parameters inside Snowflake driver log files.
Snowflake login events or query executions originating from IP addresses or user agents that do not match the workloads authorized to run the affected drivers.
Cloud-storage GetObject requests against Snowflake stage buckets that reuse pre-signed URLs from log aggregation systems or CI/CD job outputs.

Detection Strategies

Scan historical and live logs from Snowflake drivers for regex patterns matching JSON Web Tokens (JWTs), SAML <Assertion> elements, and pre-signed cloud-storage URL query parameters.
Correlate Snowflake LOGIN_HISTORY and QUERY_HISTORY records with the set of hosts and service accounts that legitimately run the affected drivers, alerting on deviations.
Inspect CI/CD job artifacts and pipeline logs for Snowflake driver debug output, treating any hit as a credential exposure event.

Monitoring Recommendations

Enable ingestion of Snowflake account usage views and cloud-storage access logs into a centralized analytics platform for continuous correlation.
Alert on read access to log storage locations by principals outside of the observability and platform engineering teams.
Track driver version distribution across the estate and flag hosts still running versions prior to the fixed releases.

How to Mitigate CVE-2026-86597

Immediate Actions Required

Upgrade all Snowflake client drivers to the fixed versions: Python Connector v4.7.3, Go Driver v2.2.0, JDBC Driver v4.3.4, Node.js Driver v3.3.0, PHP PDO Driver v4.2.0, and ODBC Driver v3.20.0.
Securely delete previously generated diagnostic logs that contain sensitive material where retention is not required, including copies in log aggregators and CI/CD artifact stores.
Rotate Snowflake authentication credentials, service account keys, and any SAML signing material that may have been exposed through prior log entries.
Invalidate long-lived pre-signed URLs where possible and shorten default expiration windows for stage-related URLs.

Patch Information

Snowflake has released fixed versions across the affected drivers. Consult the vendor release notes for driver-specific upgrade guidance: Snowflake Python Connector v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4, Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Upgrades must be applied manually.

Workarounds

Restrict read access to log destinations to a minimal set of operators and enforce access via role-based access control (RBAC) and just-in-time elevation.
Disable verbose or debug-level logging on affected drivers in production and CI/CD environments until the upgrade is complete.
Configure log pipelines to apply secondary redaction for JWTs, SAML assertions, and pre-signed URL query strings before persisting or forwarding events.

bash

# Configuration example
# See vendor release notes for driver-specific upgrade procedures.