VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 16 hours ago
VRT
391,192 CVEs tracked ·
15,442 in RASP scope ·
data as of 16 hours ago
CVE-2026-86600Published 7 days ago. NVD backfills CPE data for days or weeks after publication, and OSV and the exploit indexes lag too. Scope and status here may change.
In affected Snowflake drivers, WORKLOAD_IDENTITY authentication requests a cloud workload-identity token and attaches it to the login request without verifying that the configured host is a Snowflake endpoint. An attacker who can modify the connection configuration can cause the driver to mint a fresh attestation and send it to a host they control. The captured token can be replayed to Snowflake for its remaining lifetime in accounts where that workload identity is already registered. On Azure, the token audience is also taken from connection configuration. Combined with an attacker-controlled host, the driver can request a Managed Identity access token scoped to a non-Snowflake Azure resource and deliver it to the attacker. That path is the only case in which impact extends beyond Snowflake; it is bounded by the token lifetime and the managed identity’s permissions. Successful exploitation requires WORKLOAD_IDENTITY authentication on a workload that already has an ambient cloud identity. Patched driver versions restrict this authenticator to recognized Snowflake hosts. Users must manually upgrade.
CWE-441CWE-522
No public exploit
Nothing published shows this CVE being exploited, which is not the same as ruling it out.
CVSS E:U
In RASP's scope, but nothing published names a fix and nothing published shows an exploit. Neither of the two things VRT can act on exists, which is a claim about the available evidence, not about the vulnerability.
| Decided by | no-exploit : With no fix path, a public exploit, or a CISA record of one |
|---|---|
| Finding | Resolved from QUEUED-FOR-REVIEW: this CVE affects a known product, but nothing published names a fix and nothing published shows an exploit. That is a statement about the evidence, not about the defect — it does not mean the vulnerability is unimportant or unreachable, only that neither of the two things VRT can act on exists. |
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N
1 metric
VRT selects the newest version's highest entry and
publishes it as cvssScore, newest rather than largest because scores are not comparable
across versions, and highest rather than first because the first entry is frequently a CNA placeholder
scoring 0.0 over NVD's own analysis.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 8.2 | HIGH | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N |
SNOWFLAKE | Secondary | published |
| Published | 2026-09-08 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-09-10 | NVD's own last-modified date for this record. |