CVE-2026-85528

Snowflake JDBC Driver auto-configuration account validation permits credential redirection

CVSS 3.1 5.3 MEDIUMCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-85528

Published

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-85528

Published

net.snowflake:snowflake-jdbc

https://repo.maven.apache.org/maven2

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Snowflake",
                    "product": "Snowflake JDBC Driver",
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "net.snowflake:snowflake-jdbc",
                    "repo": "https://github.com/snowflakedb/snowflake-jdbc",
                    "versions": [
                        {
                            "version": "4.2.0",
                            "lessThan": "4.3.4",
                            "versionType": "maven",
                            "status": "affected"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

net.snowflake:snowflake-jdbc-fips

https://repo.maven.apache.org/maven2

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Snowflake",
                    "product": "Snowflake JDBC Driver (FIPS)",
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "net.snowflake:snowflake-jdbc-fips",
                    "repo": "https://github.com/snowflakedb/snowflake-jdbc",
                    "versions": [
                        {
                            "version": "4.2.0",
                            "lessThan": "4.3.4",
                            "versionType": "maven",
                            "status": "affected"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

net.snowflake:snowflake-jdbc-thin

https://repo.maven.apache.org/maven2

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "vendor": "Snowflake",
                    "product": "Snowflake JDBC Driver (Thin)",
                    "collectionURL": "https://repo.maven.apache.org/maven2",
                    "packageName": "net.snowflake:snowflake-jdbc-thin",
                    "repo": "https://github.com/snowflakedb/snowflake-jdbc",
                    "versions": [
                        {
                            "version": "4.2.0",
                            "lessThan": "4.3.4",
                            "versionType": "maven",
                            "status": "affected"
                        }
                    ],
                    "defaultStatus": "unaffected"
                }

Original source record · Cite this exact observation · Complete original publisher JSON