CVE-2026-85528: Improper Input Validation in Snowflake Snowflake JDBC Driver

The Snowflake JDBC Driver versions 4.2.0 through 4.3.3 improperly validate the auto-configuration account identifier, enabling an attacker who can control the account value to redirect login requests to an attacker-chosen HTTPS endpoint. This redirection causes the driver to transmit reusable login credentials to the attacker, who can then replay these credentials to gain the privileges associated with them. The vulnerability specifically affects applications using jdbc:snowflake:auto with a connections.toml configuration that omits an explicit host. Ordinary JDBC URLs are not affected. The vulnerability is addressed in Snowflake JDBC Driver version 4.3.4, which users must manually upgrade to.

An attacker with the ability to control the account value in the vulnerable configuration can cause the driver to send reusable login credentials to a malicious host, enabling credential replay and unauthorized privilege escalation. This compromises confidentiality of credentials and potentially allows unauthorized access to Snowflake resources. The CVSS score is 5.3 (medium severity), reflecting network attack vector, high complexity, low privileges required, no user interaction, and high confidentiality impact.

A fix is available in Snowflake JDBC Driver version 4.3.4. Users must manually upgrade to this version to remediate the vulnerability. There is no indication that the vulnerability is mitigated by configuration changes alone. Ordinary JDBC URLs are not affected, so avoiding jdbc:snowflake:auto with connections.toml lacking explicit host can reduce exposure until patched.