CVE-2026-86597: Snowflake drivers sensitive information insertion in logs

CVE-2026-86597 · Severity: medium · CVSS 6.5 · Published 2026-09-08

Snowflake's database drivers for multiple programming languages were logging sensitive authentication credentials, encryption keys, and cloud-storage URLs to diagnostic logs without proper redaction. An attacker with access to log files—whether on a server, in a centralized logging system, or in CI/CD artifact storage—could extract valid credentials to gain unauthorized access to Snowflake accounts and cloud storage. The risk is mitigated by short credential lifetimes and the need for direct log access, but customers should upgrade immediately and delete previous diagnostic logs.

Technologies: github.com/snowflakedb/gosnowflake (Go), net.snowflake:snowflake-jdbc (Maven), snowflake-sdk (npm), snowflake-connector-python (PyPI), Snowflake Connector for Python, Snowflake ODBC Driver, Snowflake PHP PDO Driver. Vendors: Go, Maven, npm, PyPI, Snowflake.

Quick answers

Is CVE-2026-86597 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-86597 being exploited in the wild.
How severe is CVE-2026-86597?
Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?
github.com/snowflakedb/gosnowflake (Go) <= 1.19.1, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.19.1; github.com/snowflakedb/gosnowflake/v2 (Go) < 2.2.0, SEMVER:introduced=0,fixed=2.2.0; net.snowflake:snowflake-jdbc (Maven) < 4.3.4, ECOSYSTEM:introduced=0,fixed=4.3.4; net.snowflake:snowflake-jdbc-fips (Maven) < 4.3.4, ECOSYSTEM:introduced=0,fixed=4.3.4; and 6 more.
Is there a fix for CVE-2026-86597?
Yes. github.com/snowflakedb/gosnowflake/v2 (Go): upgrade to 2.2.0 or later; net.snowflake:snowflake-jdbc (Maven): upgrade to 4.3.4 or later; net.snowflake:snowflake-jdbc-fips (Maven): upgrade to 4.3.4 or later; net.snowflake:snowflake-jdbc-thin (Maven): upgrade to 4.3.4 or later; snowflake-sdk (npm): upgrade to 3.3.0 or later; snowflake-connector-python (PyPI): upgrade to 4.7.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-86597 attacked?
It is attacked with local access.
Am I affected by CVE-2026-86597?
Check whether you run github.com/snowflakedb/gosnowflake (Go), github.com/snowflakedb/gosnowflake/v2 (Go), net.snowflake:snowflake-jdbc (Maven) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • github.com/snowflakedb/gosnowflake/v2 (Go): upgrade to 2.2.0 or later
    go get github.com/snowflakedb/gosnowflake/v2@v2.2.0
  • net.snowflake:snowflake-jdbc (Maven): upgrade to 4.3.4 or later
    # set net.snowflake:snowflake-jdbc to 4.3.4 in your pom.xml or build.gradle
  • net.snowflake:snowflake-jdbc-fips (Maven): upgrade to 4.3.4 or later
    # set net.snowflake:snowflake-jdbc-fips to 4.3.4 in your pom.xml or build.gradle
  • net.snowflake:snowflake-jdbc-thin (Maven): upgrade to 4.3.4 or later
    # set net.snowflake:snowflake-jdbc-thin to 4.3.4 in your pom.xml or build.gradle
  • snowflake-sdk (npm): upgrade to 3.3.0 or later
    npm install snowflake-sdk@3.3.0
  • snowflake-connector-python (PyPI): upgrade to 4.7.3 or later
    pip install "snowflake-connector-python>=4.7.3"

Technical details

The vulnerability is an information disclosure flaw in diagnostic logging across six Snowflake drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC). The root cause is incomplete redaction logic that failed to mask authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions in all log paths and data types. Attack vector is local or logical access to the log destination (filesystem, log aggregation services, or CI/CD artifact stores); no network or authentication bypass is required. Successful exploitation allows credential theft if the credentials remain valid at time of access. Patches are available: Python v4.7.3, Go v2.2.0, JDBC v4.3.4, Node.js v3.3.0, PHP PDO v4.2.0, and ODBC v3.20.0.

Affected products

  • Snowflake Connector for Python before 4.7.3
  • Snowflake Go Driver before 2.2.0
  • Snowflake JDBC Driver before 4.3.4
  • Snowflake Node.js Driver before 3.3.0
  • Snowflake PHP PDO Driver before 4.2.0
  • Snowflake ODBC Driver before 3.20.0

Identifiers

  • CVE-2026-86597
  • GHSA-qqj6-54q6-cxv6
  • GO-2026-6665
  • PYSEC-2026-4301

Timeline

  • 2026-09-08: disclosed
  • 2026-09-08: patched: Patches available for all affected drivers

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.