Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Snowflake | Snowflake JDBC Driver | unaffected |
|
No data.
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
No advisories yet.
Fri, 04 Sep 2026 08:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4. Users must manually upgrade. | |
| Title | Snowflake JDBC Driver auto-configuration account validation permits credential redirection | |
| Weaknesses | CWE-20 CWE-918 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Subscriptions
No data.
MITRE
Status: PUBLISHED
Assigner: SNOWFLAKE
Published:
Updated: 2026-09-04T08:36:28.553Z
Reserved: 2026-09-04T08:34:57.842Z
Link: CVE-2026-85528
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-09-04T09:17:11.733
Modified: 2026-09-04T09:17:11.733
Link: CVE-2026-85528
Redhat
No data.
OpenCVE Enrichment
Updated: 2026-09-04T09:30:04Z