CVE-2026-86597 describes a vulnerability in multiple Snowflake drivers where sensitive information such as authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions were inserted into diagnostic log files. This happened because the existing log redaction mechanisms did not cover all affected log paths and data types. An attacker with read access to the log destination—whether local filesystem, log aggregation service, or CI/CD artifact store—could extract these sensitive credentials. The ability to exploit this vulnerability is limited to those with read access to logs, and the impact is constrained by the lifetime of the credentials and the scope of the affected objects. The vulnerability has a CVSS 3.1 score of 6.5 (medium severity). A fix is available in patched versions, and users are advised to upgrade and securely delete any previously generated logs containing sensitive data.

An attacker who can read the diagnostic logs may obtain sensitive authentication tokens, encryption keys, pre-signed URLs, and SAML assertions. If these credentials are still valid, the attacker could authenticate to the corresponding Snowflake account or cloud storage objects. The impact is limited by the credential lifetime and the scope of the affected objects. There is no indication of integrity or availability impact. Exploitation requires read access to the log destination.

A fix is available in patched versions of the affected Snowflake drivers. Users must manually upgrade to these patched versions. Additionally, users should securely delete any previously generated diagnostic logs that contain sensitive information if retention of these logs is not required. No other mitigation or temporary fix is indicated.