Vulnerability-Lookup

CVE-2026-86597 (GCVE-0-2026-86597)

Vulnerability from cvelistv5 – Published: 2026-09-08 08:24 – Updated: 2026-09-08 12:22

Title

Sensitive information written to logs by Snowflake drivers

Summary

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.

Severity

6.5 (Medium)


                        
                          CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-08 12:22 UTC

CWE

CWE-532 - Insertion of Sensitive Information into Log File

Assigner

SNOWFLAKE

References

6 references

URL	Tags
https://github.com/snowflakedb/snowflake-connecto…
https://docs.snowflake.com/en/release-notes/clien…
https://docs.snowflake.com/en/release-notes/clien…
https://docs.snowflake.com/en/release-notes/clien…
https://docs.snowflake.com/en/release-notes/clien…
https://docs.snowflake.com/en/release-notes/clien…

Impacted products

6 products

Vendor	Product	Version	CPE status
Snowflake	Snowflake Connector for Python	Affected: 0 , < 4.7.3 (python)	guessed
Snowflake	Snowflake Go Driver	Affected: 0 , < 2.2.0 (semver)	guessed
Snowflake	Snowflake JDBC Driver	Affected: 0 , < 4.3.4 (maven)	guessed
Snowflake	Snowflake Node.js Driver	Affected: 0 , < 3.3.0 (npm)	guessed
Snowflake	Snowflake PHP PDO Driver	Affected: 3.4.0 , < 4.2.0 (semver)	guessed
Snowflake	Snowflake ODBC Driver	Affected: 3.16.0 , < 3.20.0 (semver)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-86597",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-08T12:22:44.788390Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-08T12:22:54.846Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Connector for Python",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Go Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake JDBC Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Node.js Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "npm"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake PHP PDO Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.2.0",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake ODBC Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "3.20.0",
              "status": "affected",
              "version": "3.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-532",
              "description": "Insertion of Sensitive Information into Log File",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-08T08:24:15.020Z",
        "orgId": "412d305a-227d-44f9-a262-a31ba44f2aea",
        "shortName": "SNOWFLAKE"
      },
      "references": [
        {
          "name": "Snowflake Connector for Python Release Notes",
          "url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"
        },
        {
          "name": "Snowflake Go Driver Release Notes",
          "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026"
        },
        {
          "name": "Snowflake JDBC Driver Release Notes",
          "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026"
        },
        {
          "name": "Snowflake Node.js Driver Release Notes",
          "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026"
        },
        {
          "name": "Snowflake PHP PDO Driver Release Notes",
          "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026"
        },
        {
          "name": "Snowflake ODBC Driver Release Notes",
          "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026"
        }
      ],
      "title": "Sensitive information written to logs by Snowflake drivers",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea",
    "assignerShortName": "SNOWFLAKE",
    "cveId": "CVE-2026-86597",
    "datePublished": "2026-09-08T08:24:15.020Z",
    "dateReserved": "2026-09-08T08:21:54.812Z",
    "dateUpdated": "2026-09-08T12:22:54.846Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-86597",
      "date": "2026-09-08",
      "epss": "0.00087",
      "percentile": "0.00392"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-86597\",\"sourceIdentifier\":\"412d305a-227d-44f9-a262-a31ba44f2aea\",\"published\":\"2026-09-08T09:18:21.877\",\"lastModified\":\"2026-09-08T13:17:31.043\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.\"}],\"affected\":[{\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\",\"affectedData\":[{\"vendor\":\"Snowflake\",\"product\":\"Snowflake Connector for Python\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.7.3\",\"versionType\":\"python\",\"status\":\"affected\"}]},{\"vendor\":\"Snowflake\",\"product\":\"Snowflake Go Driver\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"2.2.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Snowflake\",\"product\":\"Snowflake JDBC Driver\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"4.3.4\",\"versionType\":\"maven\",\"status\":\"affected\"}]},{\"vendor\":\"Snowflake\",\"product\":\"Snowflake Node.js Driver\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"0\",\"lessThan\":\"3.3.0\",\"versionType\":\"npm\",\"status\":\"affected\"}]},{\"vendor\":\"Snowflake\",\"product\":\"Snowflake PHP PDO Driver\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.4.0\",\"lessThan\":\"4.2.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Snowflake\",\"product\":\"Snowflake ODBC Driver\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"3.16.0\",\"lessThan\":\"3.20.0\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.0,\"impactScore\":4.0}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-08T12:22:44.788390Z\",\"id\":\"CVE-2026-86597\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-532\"}]}],\"references\":[{\"url\":\"https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"},{\"url\":\"https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"},{\"url\":\"https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"},{\"url\":\"https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"},{\"url\":\"https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"},{\"url\":\"https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3\",\"source\":\"412d305a-227d-44f9-a262-a31ba44f2aea\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-86597\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-08T12:22:44.788390Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-08T12:22:51.257Z\"}}], \"cna\": {\"title\": \"Sensitive information written to logs by Snowflake drivers\", \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"CHANGED\", \"version\": \"3.1\", \"baseScore\": 6.5, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"NONE\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Snowflake\", \"product\": \"Snowflake Connector for Python\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.7.3\", \"versionType\": \"python\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Snowflake\", \"product\": \"Snowflake Go Driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"2.2.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Snowflake\", \"product\": \"Snowflake JDBC Driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"4.3.4\", \"versionType\": \"maven\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Snowflake\", \"product\": \"Snowflake Node.js Driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"lessThan\": \"3.3.0\", \"versionType\": \"npm\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Snowflake\", \"product\": \"Snowflake PHP PDO Driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.4.0\", \"lessThan\": \"4.2.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}, {\"vendor\": \"Snowflake\", \"product\": \"Snowflake ODBC Driver\", \"versions\": [{\"status\": \"affected\", \"version\": \"3.16.0\", \"lessThan\": \"3.20.0\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"references\": [{\"url\": \"https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3\", \"name\": \"Snowflake Connector for Python Release Notes\"}, {\"url\": \"https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026\", \"name\": \"Snowflake Go Driver Release Notes\"}, {\"url\": \"https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026\", \"name\": \"Snowflake JDBC Driver Release Notes\"}, {\"url\": \"https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026\", \"name\": \"Snowflake Node.js Driver Release Notes\"}, {\"url\": \"https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026\", \"name\": \"Snowflake PHP PDO Driver Release Notes\"}, {\"url\": \"https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026\", \"name\": \"Snowflake ODBC Driver Release Notes\"}], \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-532\", \"description\": \"Insertion of Sensitive Information into Log File\"}]}], \"providerMetadata\": {\"orgId\": \"412d305a-227d-44f9-a262-a31ba44f2aea\", \"shortName\": \"SNOWFLAKE\", \"dateUpdated\": \"2026-09-08T08:24:15.020Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-86597\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-09-08T12:22:54.846Z\", \"dateReserved\": \"2026-09-08T08:21:54.812Z\", \"assignerOrgId\": \"412d305a-227d-44f9-a262-a31ba44f2aea\", \"datePublished\": \"2026-09-08T08:24:15.020Z\", \"assignerShortName\": \"SNOWFLAKE\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-86597

Vulnerability from fkie_nvd - Published: 2026-09-08 09:18 - Updated: 2026-09-08 13:17

Severity

6.5 (Medium) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Summary

References

	URL	Tags
	412d305a-227d-44f9-a262-a31ba44f2aea	https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026
	412d305a-227d-44f9-a262-a31ba44f2aea	https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026
	412d305a-227d-44f9-a262-a31ba44f2aea	https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026
	412d305a-227d-44f9-a262-a31ba44f2aea	https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026
	412d305a-227d-44f9-a262-a31ba44f2aea	https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026
	412d305a-227d-44f9-a262-a31ba44f2aea	https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Connector for Python",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.7.3",
              "status": "affected",
              "version": "0",
              "versionType": "python"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Go Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "2.2.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake JDBC Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.3.4",
              "status": "affected",
              "version": "0",
              "versionType": "maven"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake Node.js Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "3.3.0",
              "status": "affected",
              "version": "0",
              "versionType": "npm"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake PHP PDO Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "4.2.0",
              "status": "affected",
              "version": "3.4.0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Snowflake ODBC Driver",
          "vendor": "Snowflake",
          "versions": [
            {
              "lessThan": "3.20.0",
              "status": "affected",
              "version": "3.16.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required."
    }
  ],
  "id": "CVE-2026-86597",
  "lastModified": "2026-09-08T13:17:31.043",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "LOCAL",
          "availabilityImpact": "NONE",
          "baseScore": 6.5,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "NONE",
          "privilegesRequired": "LOW",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "version": "3.1"
        },
        "exploitabilityScore": 2.0,
        "impactScore": 4.0,
        "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-86597",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-08T12:22:44.788390Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-08T09:18:21.877",
  "references": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026"
    },
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026"
    },
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026"
    },
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026"
    },
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026"
    },
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"
    }
  ],
  "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-532"
        }
      ],
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "type": "Secondary"
    }
  ]
}

GHSA-5CWM-P7PJ-GQP2

Vulnerability from github – Published: 2026-09-08 09:35 – Updated: 2026-09-08 09:35

Details

Severity

6.5 (Medium)


                  
                    CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-86597"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-532"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-09-08T09:18:21Z",
    "severity": "MODERATE"
  },
  "details": "Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.",
  "id": "GHSA-5cwm-p7pj-gqp2",
  "modified": "2026-09-08T09:35:39Z",
  "published": "2026-09-08T09:35:39Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-86597"
    },
    {
      "type": "WEB",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/golang-2026#version-220-sep-03-2026"
    },
    {
      "type": "WEB",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026"
    },
    {
      "type": "WEB",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/nodejs-2026#version-330-september-3-2026"
    },
    {
      "type": "WEB",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/odbc-2026#version-3200-sep-3-2026"
    },
    {
      "type": "WEB",
      "url": "https://docs.snowflake.com/en/release-notes/clients-drivers/php-pdo-2026#version-420-sep-3-2026"
    },
    {
      "type": "WEB",
      "url": "https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-86597 (GCVE-0-2026-86597)

FKIE_CVE-2026-86597

GHSA-5CWM-P7PJ-GQP2

Tags

Sightings

Nomenclature