CVE-2026-86600— Snowflake 驱动 登录前身份认证缺陷
一分钟漏洞结论
影响对象
Snowflake Snowflake Connector for Python
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
在受影响的 Snowflake 驱动程序中，WORKLOAD_IDENTITY 认证会请求一个云工作负载身份令牌，并将其附加到登录请求中，但未验证所配置的主机是否为 Snowflake 端点。能够修改连接配置的 attackers 可以诱导驱动程序生成一个新的证明令牌（attestation token），并将其发送至攻击者控制的主机。被截获的令牌可以在该工作负载身份已注册的账户中，在其剩余有效期内被重放到 Snowflake。在 Azure 上，令牌的目标受众（audience）也是从连接配置中获取的。结合攻击者
影响版本矩阵 8
| 厂商 | 产品 | 版本范围 | 状态 |
|---|---|---|---|
| Snowflake | Snowflake Connector for .NET | 4.7.0< 6.1.0 |
affected |
| Snowflake | Snowflake Connector for Python | 3.14.1< 4.7.3 |
affected |
| Snowflake | Snowflake Go Driver | 1.15.0< 2.2.0 |
affected |
| Snowflake | Snowflake JDBC Driver | 3.24.0< 4.3.4 |
affected |
| Snowflake | Snowflake Libsnowflakeclient | 2.2.0< 2.10.0 |
affected |
| Snowflake | Snowflake Node.js Driver | 2.1.1< 3.3.0 |
affected |
| Snowflake | Snowflake ODBC Driver | 3.9.0< 3.20.0 |
affected |
| Snowflake | Snowflake PHP PDO Driver | 3.6.0< 4.2.0 |
affected |
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-86600 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Workload identity attestation generated before login host validation in Snowflake drivers
来源: CVE Program / CVE List V5
Vulnerability Description
In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a fresh attestation and send it to a host they control. The captured token can be replayed to Snowflake for its remaining lifetime in accounts where that workload identity is already registered. On Azure, the token audience is also taken from connection configuration. Combined with an attacker-controlled host, the driver can request a Managed Identity access token scoped to a non-Snowflake Azure resource and deliver it to the attacker. That path is the only case in which impact extends beyond Snowflake; it is bounded by the token lifetime and the managed identity’s permissions. Successful exploitation requires WORKLOAD_IDENTITY authentication on a workload that already has an ambient cloud identity. Patched driver versions restrict this authenticator to recognized Snowflake hosts. Users must manually upgrade.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
来源: CVE Program / CVE List V5
Vulnerability Type
不充分的凭证保护机制
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Snowflake | Snowflake Connector for Python | 3.14.1 ~ 4.7.3 | - |
|
| Snowflake | Snowflake Go Driver | 1.15.0 ~ 2.2.0 | - |
|
| Snowflake | Snowflake JDBC Driver | 3.24.0 ~ 4.3.4 | - |
|
| Snowflake | Snowflake Node.js Driver | 2.1.1 ~ 3.3.0 | - |
|
| Snowflake | Snowflake Connector for .NET | 4.7.0 ~ 6.1.0 | - |
|
| Snowflake | Snowflake ODBC Driver | 3.9.0 ~ 3.20.0 | - |
|
| Snowflake | Snowflake PHP PDO Driver | 3.6.0 ~ 4.2.0 | - |
|
| Snowflake | Snowflake Libsnowflakeclient | 2.2.0 ~ 2.10.0 | - |
|
二、漏洞 CVE-2026-86600 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-86600 的情报信息
请登录查看更多情报信息。
CVE-2026-86600 厂商页面 (7)
CVE-2026-86600 其他参考 (1)
IV. Related Vulnerabilities
V. Comments for CVE-2026-86600
暂无评论