CVE-2026-86597: Insertion of Sensitive Information into Log File in Snowflake Snowflake Connector for Python

This vulnerability involves insertion of sensitive information into log files by Snowflake drivers (Python, Go, JDBC, Node.js, PHP PDO, ODBC). Due to incomplete log redaction, authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions could be exposed in diagnostic logs. An attacker with read access to the log destination could obtain credentials and decryption keys, enabling unauthorized authentication if the credentials are still valid. The impact is limited by credential lifetime and scope. Fixed versions are available for all affected drivers, and users must upgrade and remove sensitive logs.

Exposure of sensitive authentication tokens and encryption keys in logs could allow an attacker with read access to these logs to authenticate to Snowflake accounts or access cloud storage objects. The impact depends on the validity and scope of the credentials exposed. There is no indication of active exploitation in the wild. The vulnerability requires local or log destination read access, limiting remote exploitation.

A fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4, Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users should manually upgrade to these versions. Additionally, previously generated diagnostic logs containing sensitive information should be securely deleted if retention is not required to prevent credential leakage.