---
id: CVE-2026-85528
title: >-
  Improper input validation of the auto-configuration account identifier in
  Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a
  credential-bearing login request to be redirected to an attacker-selected
  HTTPS endpoint
summary: >-
  Improper input validation of the auto-configuration account identifier in
  Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a
  credential-bearing login request to be redirected to an attacker-selected
  HTTPS endpoint. An attacker …
severity: medium
cvss: 5.3
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-20
  - CWE-918
vendor: Snowflake
product: 'net.snowflake:snowflake-jdbc'
affected:
  - 'net.snowflake:snowflake-jdbc >= 4.2.0 < 4.3.4'
  - 'net.snowflake:snowflake-jdbc-fips >= 4.2.0 < 4.3.4'
  - 'net.snowflake:snowflake-jdbc-thin >= 4.2.0 < 4.3.4'
published: '2026-09-04'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T16:17:58.980'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-85528'
references:
  - url: >-
      https://docs.snowflake.com/en/release-notes/clients-drivers/jdbc-2026#version-434-sep-03-2026
    label: 412d305a-227d-44f9-a262-a31ba44f2aea
tags:
  - nvd
  - cve.org
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-09-04T19:38:16.604972Z'
epss: 0.00182
epssPercentile: 0.08017
ingestedAt: '2026-09-08T20:10:03.163Z'
---

## Overview

Improper input validation of the auto-configuration account identifier in Snowflake JDBC Driver versions 4.2.0 through 4.3.3 allowed a credential-bearing login request to be redirected to an attacker-selected HTTPS endpoint. An attacker able to control the account value could cause the driver to transmit a reusable login credential to a host of their choosing and replay it to obtain the privileges granted to that credential. Successful exploitation requires an application using jdbc:snowflake:auto with a connections.toml section that omits an explicit host and a lower-trust principal able to set the account value; ordinary JDBC URLs are unaffected. The fix is available in Snowflake JDBC Driver version 4.3.4, including the snowflake-jdbc-fips and snowflake-jdbc-thin. Users must manually upgrade.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.