GHSA-qqj6-54q6-cxv6

Suggest an improvement
Source
https://github.com/advisories/GHSA-qqj6-54q6-cxv6
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-qqj6-54q6-cxv6
Aliases
Published
2026-10-05T22:55:47Z
Modified
2026-10-05T23:15:09Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N CVSS Calculator
Summary
Snowflake drivers writes sensitive information to logs
Details

Insertion of sensitive information into log files in the Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers allowed authentication tokens, query-result encryption keys, pre-signed cloud-storage URLs, and SAML assertions to be written to diagnostic logs in circumstances where the available log redaction did not cover all affected log paths and data types. An attacker with read access to the log destination, whether the local filesystem, a log aggregation service, or a CI/CD artifact store, could obtain credentials and decryption keys that, if still valid at the time of access, could be used to authenticate to the corresponding Snowflake account or cloud-storage object. Successful exploitation requires read access to the log destination, and impact is bounded by credential lifetime and object scope. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), Snowflake Node.js Driver v3.3.0, Snowflake PHP PDO Driver v4.2.0, and Snowflake ODBC Driver v3.20.0. Users must manually upgrade and should securely delete previously generated diagnostic logs containing sensitive information where retention is not required.

Database specific 
{
    "cwe_ids":  [
        "CWE-532"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-10-05T22:55:47Z",
    "nvd_published_at":  null,
    "severity":  "MODERATE"
}
References

Affected packages

Go
github.com/snowflakedb/gosnowflake

Package

Name
github.com/snowflakedb/gosnowflake
View open source insights on deps.dev
Purl
pkg:golang/github.com/snowflakedb/gosnowflake

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
1.19.1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
github.com/snowflakedb/gosnowflake/v2

Package

Name
github.com/snowflakedb/gosnowflake/v2
View open source insights on deps.dev
Purl
pkg:golang/github.com/snowflakedb/gosnowflake/v2

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
2.2.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
Maven
net.snowflake:snowflake-jdbc

Package

Name
net.snowflake:snowflake-jdbc
View open source insights on deps.dev
Purl
pkg:maven/net.snowflake/snowflake-jdbc

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.4

Affected versions

2.*
2.8.0
2.8.1
2.8.2
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.0.5
3.0.6
3.0.7
3.0.8
3.0.9
3.0.10
3.0.11
3.0.12
3.0.13
3.0.14
3.0.15
3.0.16
3.0.17
3.0.18
3.0.19
3.0.20
3.0.21
3.1.0
3.1.1
3.2.0
3.2.1
3.2.2
3.2.3
3.2.4
3.2.5
3.2.6
3.2.7
3.3.0
3.3.1
3.3.2
3.3.3
3.4.0
3.4.1
3.4.2
3.4.3
3.5.0
3.5.1
3.5.2
3.5.3
3.5.4
3.5.5
3.6.0
3.6.1
3.6.2
3.6.3
3.6.4
3.6.5
3.6.6
3.6.7
3.6.8
3.6.9
3.6.10
3.6.11
3.6.12
3.6.13
3.6.14
3.6.15
3.6.16
3.6.17
3.6.18
3.6.19
3.6.20
3.6.21
3.6.22
3.6.23
3.6.24
3.6.25
3.6.26
3.6.27
3.6.28
3.7.0
3.7.1
3.7.2
3.8.0
3.8.1
3.8.2
3.8.3
3.8.4
3.8.5
3.8.6
3.8.7
3.8.8
3.9.0
3.9.1
3.9.2
3.10.0
3.10.1
3.10.2
3.10.3
3.11.0
3.11.1
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.12.10
3.12.11
3.12.12
3.12.13
3.12.14
3.12.15
3.12.16
3.12.17
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.13.5
3.13.6
3.13.7
3.13.8
3.13.9
3.13.10
3.13.11
3.13.12
3.13.13
3.13.14
3.13.15
3.13.16
3.13.17
3.13.18
3.13.19
3.13.20
3.13.21
3.13.22
3.13.23
3.13.24
3.13.25
3.13.26
3.13.27
3.13.28
3.13.29
3.13.30
3.13.31
3.13.32
3.13.33
3.13.34
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.14.5
3.15.0
3.15.1
3.16.0
3.16.1
3.17.0
3.17.1
3.18.0
3.18.1
3.19.0
3.19.1
3.20.0
3.20.1
3.21.0
3.21.1
3.22.0
3.22.1
3.23.0
3.23.1
3.23.2
3.24.0
3.24.1
3.24.2
3.25.0
3.25.1
3.26.0
3.26.1
3.27.0
3.27.1
3.28.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
4.3.0
4.3.1
4.3.2
4.3.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
net.snowflake:snowflake-jdbc-thin

Package

Name
net.snowflake:snowflake-jdbc-thin
View open source insights on deps.dev
Purl
pkg:maven/net.snowflake/snowflake-jdbc-thin

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.4

Affected versions

3.*
3.14.5
3.15.0
3.15.1
3.16.0
3.16.1
3.17.0
3.17.1
3.18.0
3.18.1
3.19.0
3.19.1
3.20.0
3.20.1
3.21.0
3.21.1
3.22.0
3.22.1
3.23.0
3.23.1
3.23.2
3.24.0
3.24.1
3.24.2
3.25.0
3.25.1
3.26.0
3.26.1
3.27.0
3.27.1
3.28.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
4.3.0
4.3.1
4.3.2
4.3.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
net.snowflake:snowflake-jdbc-fips

Package

Name
net.snowflake:snowflake-jdbc-fips
View open source insights on deps.dev
Purl
pkg:maven/net.snowflake/snowflake-jdbc-fips

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.3.4

Affected versions

3.*
3.12.3
3.12.4
3.12.5
3.12.6
3.12.7
3.12.8
3.12.9
3.12.10
3.12.11
3.12.12
3.12.13
3.12.14
3.12.15
3.12.16
3.12.17
3.13.0
3.13.1
3.13.2
3.13.3
3.13.4
3.13.5
3.13.6
3.13.7
3.13.8
3.13.9
3.13.10
3.13.11
3.13.12
3.13.13
3.13.14
3.13.15
3.13.16
3.13.17
3.13.18
3.13.19
3.13.20
3.13.21
3.13.22
3.13.23
3.13.24
3.13.25
3.13.26
3.13.27
3.13.28
3.13.29
3.13.30
3.13.31
3.13.32
3.13.33
3.13.34
3.14.0
3.14.1
3.14.2
3.14.3
3.14.4
3.14.5
3.15.0
3.15.1
3.16.0
3.16.1
3.17.0
3.17.1
3.18.0
3.18.1
3.19.0
3.19.1
3.20.0
3.20.1
3.21.0
3.21.1
3.22.0
3.22.1
3.23.0
3.23.1
3.23.2
3.24.0
3.24.1
3.24.2
3.25.0
3.25.1
3.26.0
3.26.1
3.27.0
3.27.1
3.28.0
4.*
4.0.0
4.0.1
4.0.2
4.1.0
4.2.0
4.3.0
4.3.1
4.3.2
4.3.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
npm
snowflake-sdk

Package

Name
snowflake-sdk
View open source insights on deps.dev
Purl
pkg:npm/snowflake-sdk

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
3.3.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"
PyPI
snowflake-connector-python

Package

Name
snowflake-connector-python
View open source insights on deps.dev
Purl
pkg:pypi/snowflake-connector-python

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
4.7.3

Affected versions

1.*
1.4.5
1.4.6
1.4.7
1.4.8
1.4.9
1.4.10
1.4.11
1.4.12
1.4.13
1.4.14
1.4.15
1.4.16
1.4.17
1.5.0
1.5.1
1.5.2
1.5.3
1.5.4
1.5.5
1.5.6
1.5.7
1.5.8
1.6.0
1.6.1
1.6.2
1.6.3
1.6.4
1.6.5
1.6.6
1.6.7
1.6.8
1.6.9
1.6.10
1.6.11
1.6.12
1.7.0
1.7.1
1.7.2
1.7.3
1.7.4
1.7.5
1.7.6
1.7.7
1.7.8
1.7.9
1.7.10
1.7.11
1.8.0
1.8.1
1.8.2
1.8.3
1.8.4
1.8.5
1.8.6
1.8.7
1.9.1
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.2
2.1.3
2.2.0
2.2.1
2.2.2
2.2.3
2.2.4
2.2.5
2.2.6
2.2.7
2.2.8
2.2.9
2.2.10
2.3.0
2.3.1
2.3.2
2.3.3
2.3.4
2.3.5
2.3.6
2.3.7
2.3.8
2.3.9
2.3.10
2.4.0
2.4.1
2.4.2
2.4.3
2.4.4
2.4.5
2.4.6
2.5.0
2.5.1
2.6.0
2.6.1
2.6.2
2.7.0
2.7.1
2.7.2
2.7.3
2.7.4
2.7.5
2.7.6
2.7.7
2.7.8
2.7.9
2.7.10
2.7.11
2.7.12
2.8.0
2.8.1
2.8.2
2.8.3
2.9.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0a1
3.1.0a2
3.1.0
3.1.1
3.2.0
3.2.1
3.3.0b1
3.3.0
3.3.1
3.4.0
3.4.1
3.5.0
3.6.0
3.7.0
3.7.1
3.8.0
3.8.1
3.9.0
3.9.1
3.10.0
3.10.1
3.11.0
3.12.0
3.12.1
3.12.2
3.12.3
3.12.4
3.13.0
3.13.1
3.13.2
3.14.0
3.14.1
3.15.0
3.16.0
3.17.0
3.17.1
3.17.2
3.17.3
3.17.4
3.18.0
3.18.1
4.*
4.0.0
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.5.0
4.6.0
4.7.0
4.7.1
4.7.2

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qqj6-54q6-cxv6/GHSA-qqj6-54q6-cxv6.json"