CVE-2026-86600: Insufficiently Protected Credentials in Snowflake Snowflake Connector for Python

The vulnerability arises because the Snowflake Connector for Python's WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the host is a valid Snowflake endpoint. An attacker able to alter the connection configuration can cause the driver to mint a fresh attestation token and send it to an attacker-controlled host. This token can then be replayed to Snowflake for the remainder of its lifetime in accounts where the workload identity is registered. On Azure, the token audience is also configurable, allowing an attacker to request a Managed Identity access token scoped to non-Snowflake Azure resources, potentially expanding the impact beyond Snowflake. Exploitation requires that WORKLOAD_IDENTITY authentication is enabled on a workload with an ambient cloud identity. Patched versions restrict this authenticator to recognized Snowflake hosts, preventing misuse.

Successful exploitation allows an attacker who can modify the connection configuration to obtain valid workload-identity tokens and replay them to Snowflake, potentially gaining unauthorized access to Snowflake accounts. On Azure, the attacker can also obtain Managed Identity access tokens scoped to other Azure resources, limited by token lifetime and permissions of the managed identity. This can lead to credential theft and unauthorized access to cloud resources associated with the workload identity.

A patch is available that restricts the WORKLOAD_IDENTITY authenticator to recognized Snowflake hosts, preventing tokens from being sent to attacker-controlled hosts. Users must manually upgrade to patched versions of the Snowflake Connector for Python to remediate this vulnerability. No other mitigation actions are indicated by the vendor advisory.