CVE-2026-85528

Executive Summary

CVE-2026-85528 is an improper input validation vulnerability (CWE-20) in the Snowflake JDBC Driver affecting versions 4.2.0 through 4.3.3. The flaw allows a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint when the driver is used with the jdbc:snowflake:auto connection mechanism. An attacker who can influence the account identifier value could intercept a reusable login credential and replay it to obtain the privileges associated with that credential, resulting in high confidentiality impact. The vulnerability is patched in version 4.3.4, and enterprises running affected driver versions must manually upgrade to mitigate the risk.

Technical Analysis

The vulnerability arises from improper input validation of the auto-configuration account identifier within the Snowflake JDBC Driver. The issue is specific to the driver's jdbc:snowflake:auto connection type, which is a configuration mechanism designed to simplify connection setup by auto-discovering connection parameters.

Vulnerability Mechanism: The affected code path processes an "account identifier" as part of the auto-configuration workflow. When the driver has insufficient or missing explicit host configuration — specifically when a connections.toml section omits an explicit host — the driver appears to resolve the connection endpoint based on the provided account value. Due to missing validation, a crafted account identifier can cause the driver to perform the credential-exchange handshake against a hostname or HTTPS endpoint selected by the attacker.

The key weakness is the absence of an allowlist or validation routine that confirms the account-derived endpoint is an authorized Snowflake infrastructure host. Without a pinned or validated host, the account value acts as an unvalidated redirector for the credential-bearing login request.

Attack Surface: The attack surface is limited to applications that:

1. Use the jdbc:snowflake:auto connection string format.
2. Rely on a connections.toml configuration section that does not specify an explicit host parameter.
3. Permit a lower-trust principal (e.g., an unprivileged user, a configuration injection point, or a compromised application input) to set or influence the account value.

Notably, ordinary JDBC URLs (e.g., jdbc:snowflake://account.snowflakecomputing.com) are unaffected because they contain an explicit host and follow a different connection resolution path.

Why This Is High Impact Despite Moderate CVSS: The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N) scores a base value of 5.3. While the attack complexity is high (requiring controlled conditions) and privileges are low, the confidentiality impact is complete (C:H). This reflects the attacker's ability to capture a reusable authentication credential, which is fundamentally a credential theft vector.

Missing Patch Evidence: The Intel exchange indicates patch confidence of 0/4 with no tracked patch sources. However, the NVD Description states the fix is available in Snowflake JDBC Driver version 4.3.4. This means the patched version is confirmed through the description itself; the low patch confidence likely reflects a lack of published CVE-specific advisory from tracking vendors.

Exploitation Scenarios

Note: No public PoC, exploit code, or Nuclei template is available. The attack chain below is inferred from the vulnerability description and class mechanics.

Stage 1 — Reconnaissance and Target Identification: An attacker would first identify target applications that use the Snowflake JDBC Driver in the affected version range (4.2.0–4.3.3). Reconnaissance may focus on:

• Examining application configuration files or error responses that reveal JDBC connection strings containing jdbc:snowflake:auto.
• Identifying applications that use a connections.toml file for connection management.
• Determining whether the application exposes any input field, configuration API, or environment variable through which a lower-trust user can influence the account identifier.

Stage 2 — Triggering the Flaw (CWE-20, Improper Input Validation): The attacker would set or manipulate the account value within the connections.toml-driven auto-configuration path. Because the driver lacks input validation on the account identifier, the attacker provides an account value crafted to point the driver to an HTTPS endpoint the attacker controls (e.g., attacker.example.com as the resolved host for the connection handshake).

Stage 3 — Payload Delivery / Execution Mechanism-Level: At this point, when the legitimate application initiates a login using the compromised auto-configuration settings, the driver transmits the credential-bearing login request to the attacker-selected endpoint instead of a genuine Snowflake service host. The attacker's server receives the request containing the reusable credential. Because the credential is not a single-use token (it is described as "reusable"), the attacker can store and later replay it.

Stage 4 — Post-Exploitation Impact: With the stolen credential in hand, the attacker replays it against legitimate Snowflake infrastructure endpoints to authenticate as the compromised account. Depending on the privileges associated with the credential (which may be a service account or a user account with data access), the attacker gains unauthorized access to Snowflake data, can exfiltrate data, pivot to other connected systems, or compromise data integrity through subsequent SQL operations.

Success Conditions:

• The application must use jdbc:snowflake:auto.
• The connections.toml for that profile must NOT define an explicit host.
• The attacker must have any mechanism to control the account value (configuration injection, environment manipulation, or application input exploiting a separate injection point).
• The attacker must provision an HTTPS endpoint ahead of time to capture the credential.

Impact Assessment

Business Impact: Successful exploitation results in the theft of a reusable authentication credential for a Snowflake account. The immediate impact is unauthorized access to the data tier accessible via that credential. Depending on the account's privilege level, this could include read access to sensitive corporate data, financial records, PII, or business-critical analytics data. Given the confidentiality subscore of C:H, the full breadth of data accessible by the credential is at risk.

Affected Systems:

• Java applications embedding the Snowflake JDBC Driver versions 4.2.0 through 4.3.3.
• Applications using connection pooling or configuration management where the account parameter is dynamically derived or user-influences.
• Environment where application configuration (connections.toml) is not considered code and is writable by lower-trust operators.

Blast Radius: The blast radius is constrained by the specific preconditions. Environments using standard JDBC URLs are not exposed. The attack requires a lower-trust principal to control the account value and an incomplete auto-configuration setup. In a well-segmented environment with a dedicated hardening team, the reachable attack surface may be limited to specific legacy migrations or experimentation paths. However, in environments that adopted jdbc:snowflake:auto for configuration convenience without explicit host pinning, the risk extends broadly to any application using credential-bearing connections.

CVSS Context:

• Attack Vector: Network
• Attack Complexity: High — requires specific application configuration and attacker control over the account value.
• Privileges Required: Low — a lower-trust principal is needed.
• User Interaction: None.
• Confidentiality Impact: High — reusable credentials are captured.
• Integrity Impact: None.
• Availability Impact: None.

Detection Guidance

Sigma Rule

The following Sigma rule detects attempts to exploit CVE-2026-85528 by flagging uncommon connection string patterns. It detects anomalous or untrusted account values in JDBC auto-connection configurations — useful for logging and monitoring application code paths that parse connection profiles.

title: Suspicious Snowflake JDBC Auto-Config Account Value
id: a6b3e1d7-55e4-4f11-94bf-7a5f10d9f301
status: experimental
description: Detects Snowflake JDBC auto-configuration connection attempts where the account value appears suspicious or includes external host hints, indicating potential exploitation of CVE-2026-85528.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85528
author: Valters IT Threat Intel
date: 2026/10/09
logsource:
    category: process_creation
    product: windows
detection:
    selection_jdbc_auto:
        Image|endswith: \java.exe
        CommandLine|contains|all:
            - 'jdbc:snowflake:auto'
    selection_suspicious_account:
        CommandLine|contains:
            - 'account=http'
            - 'account=//'
            - 'account=www.'
            - 'account=.*\.com'
    condition: selection_jdbc_auto and selection_suspicious_account
level: high
falsepositives:
    - Legitimate configurations pointing to private or internal Snowflake accounts
    - Test environments using non-standard hosts
    - Development staging connection retry attempts

YARA Rule

This YARA rule scans source code, configuration files, and binary strings for dangerous JDBC auto-configuration patterns — catching components that reference both an external HTTPS endpoint and the connections.toml-driven login path.

rule CVE_2026_85528_Snowflake_AutoConfig_Account_Exfil
{
    meta:
        author = "Valters IT Threat Intel"
        description = "Detects Snowflake JDBC auto-configuration code paths that pass account values that could redirect login credentials to external HTTPS endpoints"
        cve = "CVE-2026-85528"
        date = "2026-10-09"
        version = "1.0"
    strings:
        $s_jdbc_auto = "jdbc:snowflake:auto" ascii wide nocase
        $s_connections = "connections.toml" ascii wide nocase
        $s_account_key = "account" ascii wide nocase
        $s_http_tag = "https://" ascii wide nocase
        $s_http_tag2 = "http://" ascii wide nocase
    condition:
        ( uint16(0) == 0x5A4D or filesize < 2MB ) and
        $s_jdbc_auto and $s_account_key and
        ( $s_http_tag or $s_http_tag2 )
}

Suricata IDS Rule

The following Suricata rule inspects outbound TLS SNI and HTTP requests that originate from Java application processes interacting with known malicious or surveilled account-endpoint redirection. It aligns with attacker-controlled HTTPS endpoints that receive legitimate login traffic during exploitation.

alert tls $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-85528 Snowflake JDBC Auto-Config Credential Exfiltration Attempt"; flow:to_server,established; tls.sni; content:"snowflakecomputing.com"; nocase; pcre:"/(?!^[a-z0-9-]+\.snowflakecomputing\.com$)/i"; sid:202685528; rev:1; metadata:cve CVE-2026-85528; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-85528;)

Elastic Detection

The following Elastic EQL rule identifies correlation between a JDBC login event and a network connection to an unusual destination — indicating possible credential redirection.

sequence by process.entity_id
  [ process where process.name == "java" and
    process.command_line : ("*jdbc:snowflake:auto*", "*connections.toml*") and
    process.command_line : ("*account*")
  ]
  [ network where event.action == "connection_attempted" and
    network.protocol == "tls" and
    destination.domain not in ("*.snowflakecomputing.com", "*.snowflake.net") and
    destination.port == 443
  ]

Splunk SPL Query

Search Splunk for Java processes that reference jdbc:snowflake:auto and connect to non-Snowflake endpoints, since legitimate auto-configurations should resolve only to official Snowflake domains.

index=* sourcetype=*latest*
| search process_name=java
| search "*jdbc:snowflake:auto*" OR "*connections.toml*"
| search "*account*"
| join process_id
    [ search index=* sourcetype=netconn
      | search destination_port=443
      | rex field=destination_host "(?<dest_domain>[^:]+)"
      | where NOT dest_domain LIKE "%snowflakecomputing.com%"
      | where NOT dest_domain LIKE "%snowflake.net%"
      | stats count by dest_domain]
| table _time, host, source, dest_domain, process_name, user
| sort - _time

Wazuh OSSEC Rule

The Wazuh rule below flags auditd or Windows Security log events where a Java process references the vulnerable connection string and follows an unexpected network path.

<group name="snowflake,">
  <rule id="808753" level="10">
    <decoded>auditd</decoded>
    <field name="proctitle">.jdbc:snowflake:auto.</field>
    <field name="proctitle">.account.</field>
    <description>CVE-2026-85528: Snowflake JDBC auto-configuration with account input detected on process.</description>
    <group>credential_exfil,snowflake_jdbc,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="808754" level="12">
    <decoded>auditd</decoded>
    <field name="socket">https://</field>
    <field name="proctitle">.snowflake:auto.</field>
    <description>CVE-2026-85528: internal Java process attempting HTTPS to external host via auto-config.</description>
    <group>credential_exfil,snowflake_jdbc,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Immediate Mitigations

1. Identify affected deployments: Audit all applications using the Snowflake JDBC Driver to determine which versions are in use. Focus on versions 4.2.0 through 4.3.3.
2. Pin explicit hosts:
   • Where jdbc:snowflake:auto is used, edit the relevant connections.toml section to include an explicit host entry pointing to a legitimate Snowflake address (e.g., account.snowflakecomputing.com).
   • This eliminates the resolution path that lets attacker-controlled account values redirect the connection.
3. Restrict privilege on account configuration:
   • Ensure that file-system permissions on configuration files or runtime parameters controlling the account value are limited to trusted administrators only. Remove write access from lower-trust principals.
4. Monitor and log: Activate logging for JDBC login attempts, especially any failures or handshake transactions that cross to unexpected external hosts. Deploy network monitoring on outbound TLS traffic from Java application hosts.
5. Temporarily disable auto-config: If direct upgrade is not immediately feasible, consider temporarily reverting to legacy JDBC URLs (jdbc:snowflake://) or disabling jdbc:snowflake:auto functionality until a full patch is deployed.

Patch / Upgrade Steps

1. The vendor confirms the fix is available in Snowflake JDBC Driver version 4.3.4.
2. Upgrade all application dependencies from affected versions to 4.3.4 or later.
   • Maven/Gradle: update the snowflake-jdbc artifact version to 4.3.4.
   • Verify by running: mvn dependency:tree or gradle dependencyInsight to confirm no transitive dependency pins an older version.
3. Re-run integration tests to ensure that auto-configuration connections still function with the patched driver and that account values containing external hosts are rejected.
4. After upgrade, re-audit the connections.toml files to ensure no legacy sections still omit the explicit host.

Long-Term Hardening

1. Treat configuration as code: Version control your connections.toml files and perform code reviews on changes to account or host values. Include static checks to prevent omission of explicit host entries.
2. Secrets management: Rather than embedding credentials or configuration in application input that can be influenced, migrate credential management to a secrets vault (e.g., HashiCorp Vault or cloud secrets manager) with rotation policies.
3. Network egress controls: Implement egress firewalling or zero-trust policy so that Java hosts can only establish TLS connections to a whitelist of Snowflake IP ranges and DNS names. This could stop credential exfiltration before it leaves the environment.
4. Vendor adoption of CVE data: Validate that your CVE feed and dependency scanning tools have ingested the vendor advisory and can automatically flag future vulnerable versions of the Snowflake JDBC Driver.
5. Credential rotation: If any production environment runs an affected version and there is reason to believe the auto-configuration flow was exposed to lower-trust personnel, rotate all Snowflake account secrets after upgrading.

References

1. NVD — CVE-2026-85528: https://nvd.nist.gov/vuln/detail/CVE-2026-85528
2. Snowflake JDBC Driver Changelog / Release Notes (confirming 4.3.4 fix): https://docs.snowflake.com/en/developer-guide/jdbc/jdbc-2026-01-01
3. MITRE ATT&CK — T1190 (Exploit Public-Facing Application): https://attack.mitre.org/techniques/T1190/
4. CWE-20 — Improper Input Validation: https://cwe.mitre.org/data/definitions/20.html
5. FIRST EPSS (no score yet for this CVE as of report date): https://www.first.org/epss/

Campaign / Exploit-in-the-Wild Evidence: No evidence of exploitation in the wild, public PoC, or known threat actor campaigns has been reported at the time of writing. The EPSS score has not yet been assigned by FIRST.org. Organizations are nonetheless advised to prioritize an upgrade since the vulnerability maps to a straightforward credential-forwarding technique that does not require complex tooling.