CVE-2026-86597 debrief based on the supplied source corpus. The CVE record was published on 2026-09-08T09:18:21.877Z and has not been modified since then. The vulnerability affects Snowflake Python, Go, JDBC, Node.js, PHP PDO, and ODBC drivers, allowing sensitive information to be written to diagnostic logs. This could lead to credential exposure and potential authentication token compromise. Defenders sh [truncated]
CVE-2026-92903 is a high-severity vulnerability in Snowflake CLI versions prior to 3.27.0, allowing unsanitized user-controlled values to be interpolated into SQL strings executed as multi-statement queries. An attacker with write or pull-request access to a project repository or the ability to supply untrusted input to CLI-wrapping automation can cause Snowflake CLI to execute attacker-controlled SQL sta [truncated]
CVE-2026-19594 debrief based on CVE Program and NVD records. The vulnerability is a high-severity issue in Snowflake Python API versions prior to 1.13.0, allowing for confused-deputy privilege escalation through path traversal and HTTP parameter pollution. This could lead to potential privilege escalation and impact applications built on snowflake.core, particularly those using EXECUTE AS OWNER stored pro [truncated]
CVE-2026-15925 involves improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1. This issue may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. To exploit this, an attacker would need on-path network access to intercept or redirect traffic and present a certificate signed by any trusted CA [truncated]
CVE-2026-15183 is a critical vulnerability in Snowflake Spark Connector versions prior to 3.2.1. Multiple input validation vulnerabilities can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. This vulnerability affects users of Snowflake Spark Connector versions prior to 3.2.1 and [truncated]
