CVE-2026-86600

Snowflake drivers that support WORKLOAD_IDENTITY authentication attach a cloud workload-identity token to login requests without verifying that the configured host is a genuine Snowflake endpoint. An attacker who can modify the connection configuration can point the connection at a host they control, causing the driver to mint a fresh attestation and hand it to the attacker, who can then replay that token to Snowflake for the remainder of its lifetime in any account where the workload identity is registered. On Azure, the token audience is also taken from the connection configuration, so the attacker can additionally make the driver request a Managed Identity access token scoped to an arbitrary non-Snowflake Azure resource and deliver it to them; this is the only path where impact extends beyond Snowflake and is bounded by the token lifetime and the managed identity's permissions. Only workloads that use WORKLOAD_IDENTITY authentication and already have an ambient cloud identity are exposed, and exploitation is not currently observed (EPSS 0.3%, not in CISA KEV, no public PoC or known exploit). Patched drivers restrict the authenticator to recognized Snowflake hosts, but users must manually upgrade.

What to do: Manually upgrade all Snowflake drivers to the patched versions (which restrict WORKLOAD_IDENTITY to recognized Snowflake hosts), checking Snowflake's advisory for the fixed release for each driver you use. Audit connection configurations for use of the WORKLOAD_IDENTITY authenticator, identify which accounts have the corresponding workload identity registered, and restrict who can modify connection settings; Azure users should also review managed-identity permissions and non-Snowflake audiences reachable via the connection config.