Answer in brief
CVE-2026-86597 records a Unknown severity vulnerability in Sensitive information written to logs by Snowflake drivers. The current sources do not mark it as known exploited. The current feed maps Snowflake/Snowflake Connector for Python (generic), Snowflake/Snowflake Go Driver (generic), Snowflake/Snowflake JDBC Driver (generic), Snowflake/Snowflake Node.js Driver (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Snowflake/Snowflake Connector for Python (generic), Snowflake/Snowflake Go Driver (generic), Snowflake/Snowflake JDBC Driver (generic), Snowflake/Snowflake Node.js Driver (generic) and additional mapped packages. Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Snowflake/Snowflake Connector for Pythongeneric | >=0 <4.7.3 | 4.7.3 |
| Snowflake/Snowflake Go Drivergeneric | >=0 <2.2.0 | 2.2.0 |
| Snowflake/Snowflake JDBC Drivergeneric | >=0 <4.3.4 | 4.3.4 |
| Snowflake/Snowflake Node.js Drivergeneric | >=0 <3.3.0 | 3.3.0 |
| Snowflake/Snowflake ODBC Drivergeneric | >=3.16.0 <3.20.0 | 3.20.0 |
| Snowflake/Snowflake PHP PDO Drivergeneric | >=3.4.0 <4.2.0 | 4.2.0 |
Published upstream
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 8, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 8, 2026
Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in the patched versions listed above. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.
Quoted source text, attributed separately from HOL analysis.