CVE-2026-86600: Snowflake Driver Auth Bypass Vulnerability

CVE-2026-86600 Overview

CVE-2026-86600 affects multiple Snowflake drivers that implement WORKLOAD_IDENTITY authentication. The drivers request a cloud workload-identity token and attach it to the login request without validating that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can redirect the driver to a host they control and capture a freshly minted attestation token. The captured token can then be replayed to Snowflake for the remainder of its lifetime in accounts where the workload identity is already registered. The flaw is categorized under CWE-441: Unintended Proxy or Intermediary.

Critical Impact
On Azure, the token audience is also sourced from connection configuration, allowing an attacker-controlled host to receive a Managed Identity access token scoped to a non-Snowflake Azure resource, extending impact beyond Snowflake up to the managed identity's permissions.

Affected Products

Snowflake .NET Driver prior to 6.1.0
Snowflake Go Driver prior to 2.2.0, JDBC Driver prior to 4.3.4, Node.js Driver prior to 3.3.0
Snowflake ODBC Driver prior to 3.2.00, PHP PDO Driver prior to 4.2.0, libsnowflakeclient prior to 2.10.0, and Python Connector prior to 4.7.3

Discovery Timeline

2026-09-08 - CVE-2026-86600 published to NVD
2026-09-10 - Last updated in NVD database

Technical Details for CVE-2026-86600

Vulnerability Analysis

The vulnerability resides in the WORKLOAD_IDENTITY authenticator implementation across Snowflake's driver ecosystem. When a client initiates authentication, the driver queries the local cloud metadata service (AWS IMDS, Azure IMDS, or GCP metadata) for a workload-identity attestation. The driver then sends that attestation to the host specified in the connection configuration. The drivers do not verify that the configured host belongs to Snowflake's known endpoint set before transmitting the credential.

An attacker who controls or modifies the connection string can point the driver at an arbitrary server. The workload token is minted using the ambient cloud identity of the executing workload and delivered to the attacker's endpoint. Once captured, the token remains valid until it expires and can be replayed against legitimate Snowflake accounts where the identity is registered.

Root Cause

The root cause is missing endpoint validation in the authenticator path. The driver treats the host field as trusted input and mints credentials before establishing that the target is a Snowflake service. This corresponds to [CWE-441], where the driver becomes an unintended intermediary that hands cloud-issued credentials to an untrusted party.

Attack Vector

Exploitation requires the ability to modify the Snowflake connection configuration used by a workload that already has an ambient cloud identity. On Azure, the impact broadens because the audience parameter for the Managed Identity token is also configuration-driven. An attacker can request a token scoped to a non-Snowflake Azure resource, receive it at their host, and use it against that unrelated Azure service within the token's lifetime and permission scope.

No verified proof-of-concept code is published. Refer to the Snowflake JDBC Driver Release Notes and the Snowflake Python Connector v4.7.3 release for the fix details.

Detection Methods for CVE-2026-86600

Indicators of Compromise

Snowflake connection strings referencing hostnames outside the *.snowflakecomputing.com domain when authenticator=WORKLOAD_IDENTITY is set.
Outbound TLS connections from application workloads to unknown hosts immediately following calls to cloud metadata endpoints (169.254.169.254).
Azure Managed Identity token requests where the resource or audience parameter does not match a Snowflake resource identifier.
Snowflake login events for a workload identity originating from unexpected source IPs or geographies.

Detection Strategies

Inventory all applications and services using Snowflake drivers and flag any that use the WORKLOAD_IDENTITY authenticator on unpatched driver versions.
Inspect infrastructure-as-code, CI/CD variables, and secret stores for Snowflake host or account values that can be overridden by untrusted input.
Correlate metadata service token requests with subsequent egress destinations to detect tokens sent to non-Snowflake hosts.

Monitoring Recommendations

Alert on modifications to Snowflake connection configuration files, environment variables, and Kubernetes secrets carrying driver settings.
Monitor Snowflake LOGIN_HISTORY and SESSIONS views for workload identities authenticating from atypical client IPs or user agents.
On Azure, enable auditing of Managed Identity token issuance and alert on non-Snowflake audience values requested by workloads that normally target Snowflake.

How to Mitigate CVE-2026-86600

Immediate Actions Required

Upgrade all Snowflake drivers to the patched versions listed in the vendor release notes; the update must be applied manually.
Audit every workload using WORKLOAD_IDENTITY authentication and rotate or re-register the associated cloud identities if compromise is suspected.
Restrict who can modify Snowflake connection configuration in source repositories, deployment manifests, and runtime configuration stores.

Patch Information

Snowflake has released fixed versions that restrict the WORKLOAD_IDENTITY authenticator to recognized Snowflake hosts. Upgrade to Snowflake .NET Driver 6.1.0, Go Driver 2.2.0, JDBC Driver 4.3.4, Node.js Driver 3.3.0, ODBC Driver 3.2.00, PHP PDO Driver 4.2.0, libsnowflakeclientv2.10.0, or Python Connector v4.7.3.

Workarounds

Temporarily switch to a different Snowflake authenticator such as key-pair authentication or OAuth until drivers are upgraded.
Enforce egress network policies that only permit driver traffic to *.snowflakecomputing.com destinations.
On Azure, constrain Managed Identity assignments so that workloads calling Snowflake have no unrelated resource permissions that could be abused via audience redirection.

bash

# Example: enforce Snowflake-only egress at the pod level (Kubernetes NetworkPolicy)
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: snowflake-egress-only
spec:
  podSelector:
    matchLabels:
      app: snowflake-client
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
      ports:
        - protocol: TCP
          port: 443
      # Pair with a DNS or service-mesh policy that allows only *.snowflakecomputing.com