Is This vulnerability exploited in the wild?

No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

How severe is This vulnerability?

Medium severity, with a CVSS score of 6.5, published 8 September 2026.

Which products and versions are affected?

snowflake-sdk (npm) < 3.3.0; Snowflake Go Driver prior to 2.2.0; Snowflake JDBC Driver prior to 4.3.4; Snowflake Node.js Driver prior to 3.3.0; and 3 more.

Is there a fix for This vulnerability?

No fixed version is recorded yet. Users should manually upgrade to patched versions and securely delete previously generated diagnostic logs containing sensitive information where log retention is not required. Snowflake Python Driver 4.7.3, Go Driver 2.2.0, JDBC Driver 4.3.4, Node.js Driver 3.3.0, PHP PDO Driver 4.2.0, ODBC Driver 3.2.0 If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is This vulnerability attacked?

It is attacked with local access, in a software library.

Check whether you run snowflake-sdk (npm), Snowflake Go Driver, Snowflake JDBC Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Snowflake drivers sensitive information disclosure in logs

Q: Which products and versions are affected?

snowflake-sdk (npm) < 3.3.0; Snowflake Go Driver prior to 2.2.0; Snowflake JDBC Driver prior to 4.3.4; Snowflake Node.js Driver prior to 3.3.0; and 3 more.

Q: Is there a fix for This vulnerability?

No fixed version is recorded yet. Users should manually upgrade to patched versions and securely delete previously generated diagnostic logs containing sensitive information where log retention is not required. Snowflake Python Driver 4.7.3, Go Driver 2.2.0, JDBC Driver 4.3.4, Node.js Driver 3.3.0, PHP PDO Driver 4.2.0, ODBC Driver 3.2.0 If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Severity: medium · CVSS 6.5 · Published 2026-09-08

Snowflake's database drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) leaked sensitive credentials and encryption keys to diagnostic log files due to incomplete log redaction. An attacker with read access to logs—whether on disk, in a log aggregation service, or CI/CD artifact store—could obtain authentication tokens and decryption keys to compromise Snowflake accounts and cloud storage. Exploitation is limited by credential validity and the scope of permissions on accessed objects.

Technologies: snowflake-sdk (npm), Snowflake Go Driver, Snowflake JDBC Driver, Snowflake Node.js Driver, Snowflake ODBC Driver, Snowflake PHP PDO Driver. Vendors: npm, Snowflake.

Quick answers

Is This vulnerability exploited in the wild?: No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.
How severe is This vulnerability?: Medium severity, with a CVSS score of 6.5, published 8 September 2026.
Which products and versions are affected?: snowflake-sdk (npm) < 3.3.0; Snowflake Go Driver prior to 2.2.0; Snowflake JDBC Driver prior to 4.3.4; Snowflake Node.js Driver prior to 3.3.0; and 3 more.
Is there a fix for This vulnerability?: No fixed version is recorded yet. Users should manually upgrade to patched versions and securely delete previously generated diagnostic logs containing sensitive information where log retention is not required.</anigation> <parameter name="fixed_in">Snowflake Python Driver 4.7.3, Go Driver 2.2.0, JDBC Driver 4.3.4, Node.js Driver 3.3.0, PHP PDO Driver 4.2.0, ODBC Driver 3.2.0 If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is This vulnerability attacked?: It is attacked with local access, in a software library.
Am I affected?: Check whether you run snowflake-sdk (npm), Snowflake Go Driver, Snowflake JDBC Driver or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Users should manually upgrade to patched versions and securely delete previously generated diagnostic logs containing sensitive information where log retention is not required.</anigation> <parameter name="fixed_in">Snowflake Python Driver 4.7.3, Go Driver 2.2.0, JDBC Driver 4.3.4, Node.js Driver 3.3.0, PHP PDO Driver 4.2.0, ODBC Driver 3.2.0

Technical details

Multiple Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, ODBC) fail to redact authentication tokens, query-result encryption keys, pre-signed URLs, and SAML assertions from diagnostic logs. Log redaction is incomplete—certain log paths and sensitive data types fall through. An attacker who gains read access to log destinations (local filesystem, log aggregation platforms, CI/CD artifact stores) can extract credentials and encryption material for lateral movement or data access.

Affected products

Snowflake Python Driver prior to 4.7.3
Snowflake Go Driver prior to 2.2.0
Snowflake JDBC Driver prior to 4.3.4
Snowflake Node.js Driver prior to 3.3.0
Snowflake PHP PDO Driver prior to 4.2.0
Snowflake ODBC Driver prior to 3.2.0

Timeline

2026-09-08: disclosed
2026-10-05: other: Advisory withdrawn as duplicate of GHSA-qqj6-54q6-cxv6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.