Snowflake Drivers CVE-2026-86600

Exploitation requires three concurrent conditions: (1) the application must be configured to use the WORKLOAD_IDENTITY authenticator - this is an explicit non-default configuration choice, not the standard password or key-pair auth; (2) the workload must already possess an ambient cloud identity, meaning it runs on a cloud compute instance with an attached AWS IAM role, Azure Managed Identity, or GCP service account; and (3) the attacker must have write access to the connection configuration - specifically the ability to override the Snowflake host setting via connection string parameters, environment variables, or configuration files accessible to the application process. The Azure extended path additionally requires that the Managed Identity's assigned permissions cover non-Snowflake Azure resources. Exploitation is limited by the token's cloud-provider-defined validity window (typically 1 hour for Azure Managed Identity tokens). Workloads using password, key-pair, or OAuth authenticators are entirely unaffected.

The CVSS 8.2 vector (AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N) accurately reflects the compound prerequisites: low-privilege access to modify connection configuration and an environment already configured for WORKLOAD_IDENTITY with an ambient cloud identity. High complexity is warranted because the attack requires satisfying all three conditions simultaneously - not a drive-by scenario. The scope change (S:C) is justified by the Azure extended path, where the impact propagates to Azure resources outside Snowflake entirely. No active exploitation is recorded in CISA KEV and no public POC has been identified; EPSS data was not provided in source intelligence. Despite the elevated prerequisites, real-world risk is genuine for any organization that has adopted cloud-native Snowflake authentication across CI/CD pipelines, Kubernetes workloads, or managed compute, because configuration-injection vectors (environment variable overrides, config file writes in shared build environments) are realistic in those contexts - even a mid-sized data platform team in koszalin running WIF-authenticated ETL pipelines should treat patching these drivers as urgent, given the token replay window and potential Azure lateral movement. The Azure Managed Identity escalation path is bounded by token lifetime and the assigned managed identity's permissions, but those permissions frequently include broad Azure resource access in production data environments.

An attacker with write access to a Kubernetes pod's environment variables or a CI/CD pipeline's configuration store changes the Snowflake connection host to a server they control. When the ETL job executes and the driver initiates a WORKLOAD_IDENTITY login, it first fetches the pod's ambient GCP or Azure Managed Identity token and then POSTs the login request - including that fresh attestation - to the attacker's server. The attacker immediately replays the captured token against the real Snowflake endpoint, gaining access to all Snowflake resources that workload identity is authorized to reach; on Azure, they additionally use the stolen Managed Identity access token to query or modify Azure resources within the token's scope for its remaining validity window.