Is CVE-2026-86600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-86600 being exploited in the wild.

How severe is CVE-2026-86600?

High severity, with a CVSS score of 8.2, published 8 September 2026.

Which products and versions are affected?

Snowflake Drivers (general) all drivers with WORKLOAD_IDENTITY support prior to patched release; Snowflake Python Driver versions prior to patched release.

Is there a fix for CVE-2026-86600?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-86600 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-86600?

Check whether you run Snowflake Drivers (general) or Snowflake Python Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-86600: Snowflake drivers WORKLOAD_IDENTITY token leakage

CVE-2026-86600 · Severity: high · CVSS 8.2 · Published 2026-09-08

Snowflake's cloud identity drivers fail to validate that authentication requests are sent to legitimate Snowflake endpoints. An attacker who gains control over connection configuration can trick the driver into sending cloud credentials (workload identity tokens) to attacker-controlled hosts. On Azure, this can also expose access tokens scoped to non-Snowflake resources. The vulnerability allows token capture and replay, potentially compromising cloud workload identities and accessing resources they have permission to reach.

Vendors: Snowflake.

Quick answers

Is CVE-2026-86600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-86600 being exploited in the wild.
How severe is CVE-2026-86600?: High severity, with a CVSS score of 8.2, published 8 September 2026.
Which products and versions are affected?: Snowflake Drivers (general) all drivers with WORKLOAD_IDENTITY support prior to patched release; Snowflake Python Driver versions prior to patched release.
Is there a fix for CVE-2026-86600?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-86600 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-86600?: Check whether you run Snowflake Drivers (general) or Snowflake Python Driver at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is a token leakage issue in Snowflake drivers that support WORKLOAD_IDENTITY authentication. The root cause is insufficient host validation: when requesting cloud workload-identity tokens during login, the driver does not verify that the configured host is a legitimate Snowflake endpoint. An attacker with control over connection configuration can redirect token requests to an attacker-controlled host, capturing fresh attestation tokens. The captured tokens can be replayed against Snowflake for their remaining lifetime if the associated workload identity is registered in the target account. On Azure, the token audience is also sourced from connection configuration, allowing an attacker to request managed identity tokens scoped to arbitrary Azure resources. Exploitation requires the application to use WORKLOAD_IDENTITY authentication and already possess an ambient cloud identity. Patched versions restrict the authenticator to recognized Snowflake hosts; users must manually upgrade.

Affected products

Snowflake Python Driver versions prior to patched release
Snowflake Go Driver versions prior to patched release
Snowflake Drivers (general) all drivers with WORKLOAD_IDENTITY support prior to patched release

Timeline

2026-09-08: disclosed: CVE-2026-86600 publicly disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.