Description

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-08T09:18:21.877Z",
  "pubdate": "2026-09-08T09:18:21.877Z",
  "executiveSummary": "This vulnerability involves the improper storage of sensitive authentication and cryptographic material within diagnostic log files across multiple Snowflake drivers.\nThe affected components include the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers.\nThe root cause is identified as insufficient redaction logic that failed to intercept various sensitive data types, such as authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions, before writing them to disk or logging streams.\nThe primary impact is the unauthorized exposure of credentials, which an attacker with read access to log destinations (e.g., local filesystems, log aggregators, or CI/CD pipelines) can leverage to impersonate users or gain unauthorized access to cloud-storage objects.\nExploitation is contingent upon the attacker's ability to access the log storage infrastructure where the sensitive diagnostic information has been persisted.\nThe risk is bounded by the credential lifetime and the specific scope of the leaked tokens.\nTo mitigate this risk, users must manually upgrade their Snowflake drivers to the specified patched versions and sanitize existing log repositories to prevent potential secondary exploitation from historically cached sensitive data.",
  "technicalDetails": "The vulnerability stems from inadequate data sanitization routines within the diagnostic logging subsystems of various Snowflake drivers. While the drivers were intended to redact sensitive fields, the internal filtering mechanisms proved incomplete, failing to recognize and mask specific categories of sensitive information during the logging process.\nSpecifically, the flaw allows authentication tokens, cryptographic keys used for query-result encryption, pre-signed URLs facilitating access to cloud-provider storage buckets, and SAML assertions to be written to diagnostic log files in plaintext or insufficiently obfuscated formats.\nThe attack flow proceeds as follows: 1) A user or automated process triggers a function within the Snowflake driver that engages the diagnostic logging path. 2) The driver processes sensitive data points (e.g., handshake metadata, session establishment parameters, or data retrieval instructions). 3) The redaction module fails to identify these patterns, allowing the raw sensitive payload to be serialized into the log output. 4) The log output is written to a filesystem or exported to a log aggregation service. 5) An unauthorized party with read access to the log repository retrieves these files, extracts the valid authentication or decryption material, and uses this data to conduct man-in-the-middle or direct unauthorized access to the Snowflake environment or associated cloud-storage services.\nBecause diagnostic logs are often stored in insecure or centralized locations such as CI/CD artifact stores, developers' workstations, or persistent log management services, the radius of exposure is significant. Attackers do not need to exploit the Snowflake service itself; instead, they target the downstream consumers of the logs.\nThe impact is strictly linked to the validity period of the exposed tokens or keys. If a SAML assertion or an authentication token is harvested while still valid, the attacker can hijack active sessions or establish new ones. Similarly, the exposure of pre-signed URLs allows the attacker to bypass access controls on third-party cloud storage buckets until those URLs expire. Post-exploitation is limited to the privileges held by the compromised credentials or the access scope granted by the exposed pre-signed URLs. No authentication is required for the attacker to read the logs themselves, only legitimate access to the log storage medium."
}