CVE-2026-86600: Workload identity attestation generated before login host validation in Snowflake drivers
Description
In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a fresh attestation and send it to a host they control. The captured token can be replayed to Snowflake for its remaining lifetime in accounts where that workload identity is already registered. On Azure, the token audience is also taken from connection configuration. Combined with an attacker-controlled host, the driver can request a Managed Identity access token scoped to a non-Snowflake Azure resource and deliver it to the attacker. That path is the only case in which impact extends beyond Snowflake; it is bounded by the token lifetime and the managed identity’s permissions. Successful exploitation requires WORKLOAD_IDENTITY authentication on a workload that already has an ambient cloud identity. Patched driver versions restrict this authenticator to recognized Snowflake hosts. Users must manually upgrade.
Vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N · CWE-441, CWE-522
Tracked companies
Mapped from the CVE’s affected-product data, NVD CPE matches, vendor advisories or package feeds. A mapping means the vendor’s software is named, not that its hosted service was exposed.
Status incidents that name it
No tracked status incident names this CVE.
Affected vendors and products
Snowflake: Snowflake Connector for .NETSnowflake: Snowflake Connector for PythonSnowflake: Snowflake Go DriverSnowflake: Snowflake JDBC DriverSnowflake: Snowflake JDBC Driver (FIPS)Snowflake: Snowflake JDBC Driver (Thin)Snowflake: Snowflake LibsnowflakeclientSnowflake: Snowflake Node.js DriverSnowflake: Snowflake ODBC DriverSnowflake: Snowflake PHP PDO Driver
References
- CVE record on cve.org (opens in new tab)
- NVD entry (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/dotnet-2026 (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/golang-2026 (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026 (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026 (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026 (opens in new tab)
- docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026 (opens in new tab)
- github.com/snowflakedb/libsnowflakeclient/releases/tag/v2.10.0 (opens in new tab)
- github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3 (opens in new tab)
- CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (opens in new tab)
- This product uses data from the NVD API but is not endorsed or certified by the NVD. (opens in new tab)
- Known Exploited Vulnerabilities catalog from CISA. (opens in new tab)
- EPSS scores from FIRST (Exploit Prediction Scoring System). (opens in new tab)