Description

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4. Users must manually upgrade.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-04T09:17:11.733Z",
  "pubdate": "2026-09-04T09:17:11.733Z",
  "executiveSummary": "A critical vulnerability exists in the Snowflake JDBC Driver, specifically within the auto-configuration feature, classified as an improper input validation flaw. This security defect enables a malicious actor to perform a credential-bearing login redirection, facilitating the unauthorized transmission of sensitive, reusable login credentials to an attacker-controlled HTTPS endpoint.\nThe vulnerability affects Snowflake JDBC Driver versions 4.2.0 through 4.3.3. It poses a significant risk to confidentiality and integrity by allowing attackers to hijack authentication tokens and subsequently replay them to escalate privileges or gain unauthorized access to target systems.\nExploitation is contingent upon specific environmental conditions: the application must utilize the 'jdbc:snowflake:auto' connection string format while omitting an explicit host within the 'connections.toml' configuration file. Furthermore, the attacker must possess the capability to manipulate the account identifier value within the connection request. Systems utilizing standard, non-auto-configured JDBC URLs remain unaffected by this flaw. Organizations should prioritize upgrading to version 4.3.4 to effectively remediate the underlying validation failure.",
  "technicalDetails": "The root cause of this vulnerability lies in the insufficient input validation performed on the account identifier parameter within the Snowflake JDBC Driver's auto-configuration logic. When the driver is invoked using the 'jdbc:snowflake:auto' protocol, it attempts to resolve the destination host for the authentication process based on the provided account identifier.\nBecause the driver fails to adequately sanitize or constrain the account identifier input, an attacker capable of influencing this value can inject arbitrary host information. When an application configuration omits an explicit host definition in 'connections.toml', the driver's internal logic prioritizes the supplied (and potentially malicious) account string to resolve the connection endpoint.\nThe attack flow proceeds as follows: 1) The attacker initiates an authentication request through an application utilizing a vulnerable driver configuration. 2) The attacker injects a malicious, attacker-controlled HTTPS endpoint as the account identifier. 3) The JDBC driver, failing to perform strict validation, treats the injected endpoint as the legitimate Snowflake service host. 4) The driver initiates a connection to the malicious server, inadvertently transmitting sensitive, reusable authentication credentials during the handshake or initial authentication phase.\nOnce the malicious server receives these credentials, the attacker can extract the reusable login token. Given the nature of these credentials, the attacker can then replay the captured data against the legitimate Snowflake infrastructure, effectively masquerading as the authenticated user and inheriting their full set of permissions and system privileges.\nThis vulnerability is restricted to environments where the 'jdbc:snowflake:auto' mechanism is employed without explicit host binding. The exploit requires no specific elevated system privileges beyond the ability to manipulate the connection parameters processed by the driver. The technical impact is a total loss of confidentiality regarding the credentials transmitted, as the driver essentially facilitates a man-in-the-middle scenario by directing traffic to a destination determined by the attacker. By design, the driver remains unaware of the malicious redirection because it relies on the integrity of the account identifier input, which is missing proper bounds checking and origin verification."
}