Executive brief
Snowflake's database drivers for multiple programming languages were logging sensitive authentication credentials, encryption keys, and cloud-storage URLs to diagnostic logs without proper redaction. An attacker with access to log files—whether on a server, in a centralized logging system, or in CI/CD artifact storage—could extract valid credentials to gain unauthorized access to Snowflake accounts and cloud storage. The risk is mitigated by short credential lifetimes and the need for direct log access, but customers should upgrade immediately and delete previous diagnostic logs.
Technical details
The vulnerability is an information disclosure flaw in diagnostic logging across six Snowflake drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC). The root cause is incomplete redaction logic that failed to mask authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions in all log paths and data types. Attack vector is local or logical access to the log destination (filesystem, log aggregation services, or CI/CD artifact stores); no network or authentication bypass is required. Successful exploitation allows credential theft if the credentials remain valid at time of access. Patches are available: Python v4.7.3, Go v2.2.0, JDBC v4.3.4, Node.js v3.3.0, PHP PDO v4.2.0, and ODBC v3.20.0.
Affected products
- Snowflake Connector for Python before 4.7.3
- Snowflake Go Driver before 2.2.0
- Snowflake JDBC Driver before 4.3.4
- Snowflake Node.js Driver before 3.3.0
- Snowflake PHP PDO Driver before 4.2.0
- Snowflake ODBC Driver before 3.20.0
Timeline
- 2026-09-08: disclosed
- 2026-09-08: patched: Patches available for all affected drivers