EUVD-2026-70974
GHSA-cjvw-xm5r-xgpf
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Auto-config scheme plus missing host prerequisite justifies AC:H; attacker needs configuration influence (PR:L); only credential exfiltration occurs (C:H, I:N, A:N).
Primary rating from Vendor (SNOWFLAKE).
CVSS VectorVendor: SNOWFLAKE
Lifecycle Timeline
2DescriptionCVE.org
Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4. Users must manually upgrade.
AnalysisAI
Credential redirect vulnerability in Snowflake JDBC Driver 4.2.0-4.3.3 allows a lower-trust principal who can control the account identifier to cause the driver to transmit login credentials to an attacker-chosen HTTPS endpoint rather than Snowflake's legitimate servers. The attack is exclusively exercisable through the jdbc:snowflake:auto connection scheme when the connections.toml configuration omits an explicit host value; applications using ordinary JDBC URLs are entirely unaffected. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Three conditions must hold simultaneously: (1) The application must use the jdbc:snowflake:auto connection URI scheme-ordinary JDBC URLs are explicitly unaffected and do not pass through the vulnerable code path. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N, score 5.3) accurately reflects the attack profile. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: Snowflake JDBC Driver version 4.3.4, released 2026-09-03. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Snowflake Jdbc Driver
View allWorkload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to
Improper OCSP response validation across the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certi
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage
Same weakness CWE-20 – Improper Input Validation
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today