Snowflake Php Pdo Driver
Monthly
Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages.
Stack-based buffer overflow in Snowflake libsnowflakeclient and the Snowflake PHP PDO Driver allows remote attackers with no required privileges on the target application - but who control or compromise the configured SAML identity provider, or can redirect the SAML SSO endpoint - to corrupt memory during native SSO/SAML login when a user completes the flow. Only deployments using the native SSO/SAML path, specifically the Okta SAML post-back handling fixed in this release, are exposed; password and key-pair authentication deployments are not affected. The usual outcome is a crash, remote code execution is possible only in specific circumstances, and no public exploit was identified at time of analysis; the CVE is rated CVSS 6.6 (assessed AV:N/AC:H/PR:N/UI:R), consistent with a conditional, mid-tier priority.
Snowflake client drivers that implement the `authenticator=externalbrowser` single sign-on flow expose a local loopback HTTP callback listener that reflects an arbitrary request's Origin header into its CORS response and accepts the first token-bearing request during the login window without checking a login-bound CSRF state value. An attacker who can reach that listener while a victim is mid-login and wins the race to deliver the first token-bearing request can submit a forged IdP callback, causing the authentication attempt to fail; there is no token theft, authentication bypass, or data disclosure, so the CVSS 6.5 score is driven entirely by availability impact (C:N/I:N/A:H) with user interaction required (AV:N/AC:H/PR:N/UI:R). Affected are unpatched releases of the Python connector, Go driver, JDBC (including FIPS and thin artifacts), Node.js, .NET, ODBC, PHP PDO drivers, and libsnowflakeclient; fixed versions are published for each and users must upgrade manually, and no public exploit code has been identified at the time of analysis.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.
Workload Identity Federation authentication in all major Snowflake client drivers transmits cloud attestation tokens to the configured host without first verifying that host is a recognized Snowflake endpoint, enabling token exfiltration and replay. An attacker who can modify connection configuration redirects the driver to an attacker-controlled server, which receives a freshly minted cloud workload-identity token that can be replayed against real Snowflake accounts for the token's remaining lifetime. On Azure, the attack surface is wider: the driver also fetches a Managed Identity access token scoped to an arbitrary Azure resource chosen by the attacker, extending potential impact beyond Snowflake to any Azure service that workload identity can reach. No public exploit has been identified at time of analysis, but vendor-confirmed patches were released September 3, 2026 across all eight affected driver packages.
Stack-based buffer overflow in Snowflake libsnowflakeclient and the Snowflake PHP PDO Driver allows remote attackers with no required privileges on the target application - but who control or compromise the configured SAML identity provider, or can redirect the SAML SSO endpoint - to corrupt memory during native SSO/SAML login when a user completes the flow. Only deployments using the native SSO/SAML path, specifically the Okta SAML post-back handling fixed in this release, are exposed; password and key-pair authentication deployments are not affected. The usual outcome is a crash, remote code execution is possible only in specific circumstances, and no public exploit was identified at time of analysis; the CVE is rated CVSS 6.6 (assessed AV:N/AC:H/PR:N/UI:R), consistent with a conditional, mid-tier priority.
Snowflake client drivers that implement the `authenticator=externalbrowser` single sign-on flow expose a local loopback HTTP callback listener that reflects an arbitrary request's Origin header into its CORS response and accepts the first token-bearing request during the login window without checking a login-bound CSRF state value. An attacker who can reach that listener while a victim is mid-login and wins the race to deliver the first token-bearing request can submit a forged IdP callback, causing the authentication attempt to fail; there is no token theft, authentication bypass, or data disclosure, so the CVSS 6.5 score is driven entirely by availability impact (C:N/I:N/A:H) with user interaction required (AV:N/AC:H/PR:N/UI:R). Affected are unpatched releases of the Python connector, Go driver, JDBC (including FIPS and thin artifacts), Node.js, .NET, ODBC, PHP PDO drivers, and libsnowflakeclient; fixed versions are published for each and users must upgrade manually, and no public exploit code has been identified at the time of analysis.
Sensitive credential material - including authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions - was written to diagnostic log files across six Snowflake client drivers (Python, Go, JDBC, Node.js, PHP PDO, and ODBC) due to incomplete log-redaction coverage. An attacker with read access to the log destination, whether a local filesystem, a log aggregation pipeline, or a CI/CD artifact store, can extract valid credentials and decryption keys. Exploitation impact is bounded by credential lifetime and object scope, but successful use of harvested tokens provides authenticated access to the corresponding Snowflake account or cloud-storage objects. No public exploit is identified at time of analysis; vendor-released patches are available for all six drivers as of September 3, 2026.