Snowflake 4.3.4: Fix for WORKLOAD_IDENTITY Auth Bypass and Host Verification

Security Fix Summary for Snowflake 4.3.4 Vulnerability Overview The Snowflake 4.3.4 release (released on 2026-09-03) fixed multiple security vulnerabilities, primarily related to identity authentication, connection validation, and revocation checking. Scope of Impact WORKLOAD_IDENTITY Authentication Vulnerability: The authentication process did not correctly verify the target host, allowing attackers to bypass authentication using forged credentials. This affects all clients using WORKLOAD_IDENTITY authentication. Privatelink Host Detection Vulnerability: The connection parameter accepted arbitrary hostnames, allowing attackers to exploit this vulnerability for hostname spoofing. Insufficient Connection Parameter Validation: Connection parameters such as , , and lacked validation in auto-configuration, which could lead to unintended behavior. OCSP Revocation Check Issue: OCSP revocation checks were downgraded to tolerable failures upon failure, which could result in certificate revocation status not being properly validated. Sensitive Information Leakage in Logs: Debug and response logs recorded HTTP response headers containing sensitive information. Fixes 1. WORKLOAD_IDENTITY Authentication Fix: - The authentication process now verifies the target host and rejects non-Snowflake hosts. - The allowed host suffixes can be configured via the environment variable. 2. Privatelink Host Detection Fix: - Only hostnames ending with are now accepted. 3. Enhanced Connection Parameter Validation: - : Only allows letters, digits, and hyphens (used for distinguishing region labels). - : Must be a number in the range 1-65535, or or . - : Only accepts , , , , , or . 4. Improved OCSP Revocation Check: - OCSP revocation checks were changed from tolerable failures to deterministic failures to ensure that the certificate revocation status is correctly validated. 5. Handling of Sensitive Information in Logs: - Reduced the sensitive information recorded in logs; HTTP response headers no longer log sensitive flags. PoC Code The page does not include specific PoC or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Snowflake 4.3.4: Fix for WORKLOAD_IDENTITY Auth Bypass and Host Verification