Description
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
Published: 2026-09-08
Score: 6.5 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Sensitive information such as authentication tokens, query‑result encryption keys, pre‑signed cloud‑storage URLs, and SAML assertions were written to diagnostic logs by the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers. The logging system’s redaction rules did not cover all log paths or data types, allowing secrets to appear in log files. An attacker who can read the log destination—including local files, log aggregation services, or CI/CD artifact stores—could capture valid credentials or decryption keys that remain active. The impact is limited to the lifetime of the secrets and the scope of the associated Snowflake account or cloud‑storage objects.

Affected Systems

Snowflake Connector for Python, Snowflake Go Driver, Snowflake JDBC Driver, Snowflake Node.js Driver, Snowflake ODBC Driver, Snowflake PHP PDO Driver.

Risk and Exploitability

The vulnerability has a CVSS score of 6.5, indicating moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Attackers must have read access to the logs; no special privileges are required beyond that. The exploit is feasible when logs are improperly protected, and the data can be used to compromise Snowflake accounts or cloud‑storage resources while the captured tokens or keys remain valid.

Generated by OpenCVE AI on September 8, 2026 at 09:20 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade all Snowflake drivers to the patched versions listed in the release notes for Python v4.7.3, Go 2.20, JDBC 4.34, Node.js 3.30, ODBC 3.200, and PHP PDO 4.20.
  • Delete any diagnostic logs that may have been generated before the patch, especially if retention is not needed.
  • Ensure that log redaction settings cover all log paths and data types, or move sensitive logs to a protected storage location where only authorized personnel can read them.

Generated by OpenCVE AI on September 8, 2026 at 09:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 08 Sep 2026 08:30:00 +0000

Type Values Removed Values Added
Description Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
Title Sensitive information written to logs by Snowflake drivers
Weaknesses CWE-532
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: SNOWFLAKE

Published:

Updated: 2026-09-08T08:24:15.020Z

Reserved: 2026-09-08T08:21:54.812Z

Link: CVE-2026-86597

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-08T09:18:21.877

Modified: 2026-09-08T09:18:21.877

Link: CVE-2026-86597

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-08T09:30:07Z

Weaknesses
  • CWE-532

    Insertion of Sensitive Information into Log File