Snowflake Connector for Python versions before 4.7.1 improperly validate TLS certificates by not verifying that the certificate hostname matches the requested domain. This allows an attacker with on-path network access to present a valid certificate for any domain signed by a trusted CA and bypass hostname validation. Consequently, the attacker can intercept or redirect traffic, exposing sensitive data such as credentials and query results, and potentially execute arbitrary SQL commands within the victim's session context. The vulnerability is critical with a CVSS 4.0 score of 9.2. The vendor has released a fixed version 4.7.1, which users must upgrade to manually.

An attacker capable of intercepting network traffic can bypass TLS hostname verification, leading to exposure of sensitive information including credentials, query data, and staged files. Additionally, the attacker may execute arbitrary SQL commands with the privileges of the compromised Snowflake role. This can result in data disclosure, data manipulation, and unauthorized database operations. The severity is critical due to the potential for full session compromise and data exposure.

A patch is available in Snowflake Connector for Python version 4.7.1. Users must manually upgrade to this version to remediate the vulnerability. Since this is a client-side connector, the vendor does not manage the patching automatically despite the cloud service context. No other mitigations are specified in the advisory.