CVE-2026-86600: Workload identity attestation generated before login host validation in Snowflake drivers
In affected Snowflake drivers, WORKLOADIDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a fresh attestation and send it to a host they control. The captured token can be replayed to Snowflake for its remaining lifetime in accounts where that workload identity is already registered. On Azure, the token audience is also taken from connection configuration. Combined with an attacker-controlled host, the driver can request a Managed Identity access token scoped to a non-Snowflake Azure resource and deliver it to the attacker. That path is the only case in which impact extends beyond Snowflake; it is bounded by the token lifetime and the managed identity’s permissions. Successful exploitation requires WORKLOADIDENTITY authentication on a workload that already has an ambient cloud identity. Patched driver versions restrict this authenticator to recognized Snowflake hosts. Users must manually upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snowflake drivers (WORKLOAD_IDENTITY authenticator)to a version that resolves this vulnerability.Fixed in Patched driver versions restrict this authenticator to recognized Snowflake hosts. - Compensating control
Ensure WORKLOAD_IDENTITY authentication is only allowed on workloads where the configured connection host is a recognized Snowflake endpoint (since impacted drivers minted/attached tokens without verifying the host).
- Operational
If a token was potentially captured during exploitation, treat any WORKLOAD_IDENTITY managed-identity access tokens as compromised and revoke/let them expire; captured tokens can be replayed to Snowflake for their remaining lifetime.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Exposure requires a Snowflake driver using WORKLOAD_IDENTITY authentication on a workload with an ambient cloud identity, where that workload identity is already registered with Snowflake. Deployments not using this authenticator do not meet the stated exploitation prerequisites.
What access does an attacker need to exploit it?
The attacker must be able to modify the connection configuration, including directing the driver to an attacker-controlled host. Exploitation does not require user interaction, but it depends on the driver minting a fresh workload-identity token from the affected workload.
What is the impact of a captured token?
A captured workload-identity attestation can be replayed to Snowflake for the remainder of its lifetime where the identity is registered. On Azure, attacker-controlled host and audience configuration can cause a Managed Identity token for a non-Snowflake Azure resource to be sent to the attacker; the impact is limited by the token lifetime and that identity's permissions.
What should teams do if they cannot upgrade immediately?
Prevent untrusted parties from modifying Snowflake connection configuration, especially the configured host and, on Azure, the token audience. The stated fix is to manually upgrade to patched driver versions, which restrict WORKLOAD_IDENTITY authentication to recognized Snowflake hosts.