CVE-2026-85528: medium-severity vulnerability in Snowflake JDBC Driver
Snowflake JDBC Driver auto-configuration account validation permits credential redirection
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.3%
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Affected products
Snowflake · Snowflake JDBC DriverSnowflake · Snowflake JDBC Driver (FIPS)Snowflake · Snowflake JDBC Driver (Thin)Related CVEs — Snowflake JDBC Driver
In the same product, most dangerous first.
CVE-2026-86600HIGHWorkload identity attestation generated before login host validation in Snowflake driversEPSS 0.5%CVE-2026-114456MEDIUMMissing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversEPSS 0.2%CVE-2026-85525HIGHImproper OCSP response validation in Snowflake driversEPSS 0.2%CVE-2026-86597MEDIUMSensitive information written to logs by Snowflake driversEPSS 0.1%