CVE-2026-85528

Name of the Vulnerable Software and Affected Versions Snowflake JDBC Driver versions 4.2.0 through 4.3.3

Description Improper input validation of the auto-configuration account identifier allows a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker who can control the account value can cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. This issue affects applications using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal capable of setting the account value. Ordinary JDBC URLs are not affected.

Recommendations Upgrade Snowflake JDBC Driver to version 4.3.4.