CVE-2026-86597

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.3 Snowflake Go Driver versions prior to 2.2.0 Snowflake JDBC Driver versions prior to 4.3.4 Snowflake Node.js Driver versions prior to 3.3.0 Snowflake PHP PDO Driver versions prior to 4.2.0 Snowflake ODBC Driver versions prior to 3.20.0

Description Sensitive information is written to diagnostic logs because log redaction does not cover all affected log paths and data types. This allows authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be exposed. An attacker with read access to the log destination, such as the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain these credentials and decryption keys to authenticate to the corresponding Snowflake account or cloud-storage object.

Recommendations Upgrade Snowflake Connector for Python to version 4.7.3. Upgrade Snowflake Go Driver to version 2.2.0. Upgrade Snowflake JDBC Driver to version 4.3.4. Upgrade Snowflake Node.js Driver to version 3.3.0. Upgrade Snowflake PHP PDO Driver to version 4.2.0. Upgrade Snowflake ODBC Driver to version 3.20.0. Securely delete previously generated diagnostic logs containing sensitive information where retention is not required.