Snowflake Go Driver 2.2.0 fixes: WIF host validation, URL encoding, and debug log credential masking

Snowflake Go Snowflake Driver 2.2.0 Security Fix Summary Vulnerability Overview This update (Version 2.2.0, September 3, 2026) primarily fixes multiple security vulnerabilities involving authentication, URL encoding, caching mechanisms, and log leakage. Affected Areas Authentication: A defect in the authenticator's recognition of Snowflake hosts ( , , ) allowed the environment variable to be maliciously extended. URL Encoding: In Azure Workload Identity Federation authentication requests, parameters such as resource and client ID were not correctly new URL encoded, potentially causing request failures. DSN Parameters: must resolve to a loopback or link-local address; the value is now validated to conform to URL format. OCSF Caching: Caching server and retry URLs now use Go's package instead of direct string formatting, fixing incorrect certificate state results caused by transport-layer network failures. Extension Keys: Extended keys leaked S3 SSE-C customer key headers and and URL query parameters in debug logs. HTTP Response Headers: Response headers, including chunked transfer encoding headers, were previously logged with full values, potentially leaking session tokens, storage credentials, and SSE-C customer keys. TOML Configuration: The connection configuration loader now logs only the setting names, not values, fixing parsing errors. SAS Tokens: The SAS token matching pattern was corrected to mask signed URL query parameters when logged in debug mode. Remediation Restricted the list of hosts recognized by the authenticator, with whitelist control via the environment variable. Applied new URL encoding to resource and client ID parameters in Azure Workload Identity Federation authentication requests. Validated that values conform to URL format, and restricted to loopback or link-local addresses. Used Go's package to handle OCSF caching server and retry URLs, replacing direct string formatting. Masked S3 SSE-C customer key headers and and in debug logs. Modified the HTTP response header logging logic to avoid logging full values, preventing sensitive information leakage. Modified the TOML connection configuration loader to log only setting names instead of values. Corrected the SAS token matching pattern to ensure signed URL query parameters are properly masked in debug logs. POC/Exploit Code The page did not include specific POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Snowflake Go Driver 2.2.0 fixes: WIF host validation, URL encoding, and debug log credential masking

More from this source