Snowflake JDBC Driver auto-configuration account validation permits credential redirection
Medium5.3CVE-2026-85528 · Published Sep 10, 2026
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| net.snowflake:snowflake-jdbc Maven | >= 4.2.0, < 4.3.4 | 4.3.4 |
| net.snowflake:snowflake-jdbc-fips Maven | >= 4.2.0, < 4.3.4 | 4.3.4 |
| net.snowflake:snowflake-jdbc-thin Maven | >= 4.2.0, < 4.3.4 | 4.3.4 |
Details and references
More Snowflake advisories
All Snowflake| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 17 | Snowflake CLI: improper input validation | High8.2 | 3.27.0+1 more |
| Sep 10 | Sensitive information written to logs by Snowflake drivers | Medium6.5 | 3.3.0+5 more |
| Sep 10 | Workload identity attestation generated before login host validation in Snowflake drivers | High8.2 | 3.3.0+6 more |
| Sep 10 | Improper OCSP response validation in Snowflake drivers | High7.4 | 3.3.0+3 more |
| Aug 12 | Snowflake Python APIs: privilege escalation | High8.1 | 1.13.0 |
| Jul 24 | Snowflake ODBC Driver: remote code execution | High8.8 | Snowflake libsnowflakeclient 2.9.2+2 more |