CVE-2026-85525: Improper Certificate Validation in Snowflake Snowflake Connector for Python

The vulnerability arises from improper OCSP response validation in Snowflake's Python, Go, JDBC, and Node.js drivers. OCSP responses were not reliably bound to the certificate being validated, and definitive verification failures were treated as transient, allowing revoked TLS certificates to be accepted as valid. An attacker with a revoked certificate and private key for a Snowflake or stage hostname could perform a man-in-the-middle attack, establishing a TLS session to an attacker-controlled endpoint and reading or modifying data within that connection. Exploitation requires an on-path position and possession of the private key. The issue is fixed in Snowflake Connector for Python v4.7.3, Go Driver v2.2.0, JDBC Driver v4.3.4, and Node.js Driver v3.3.0.

Successful exploitation allows a man-in-the-middle attacker holding a revoked certificate and its private key to intercept and modify data transmitted within the TLS session established by the vulnerable Snowflake drivers. The impact is limited to data confidentiality and integrity within the intercepted connection. There is no impact on availability. The vulnerability requires the attacker to have both network position and the private key corresponding to the revoked certificate.

A fix is available and users must manually upgrade to the patched versions: Snowflake Connector for Python v4.7.3, Go Driver v2.2.0, JDBC Driver v4.3.4 (including snowflake-jdbc-fips and snowflake-jdbc-thin), and Node.js Driver v3.3.0. Since this is not a cloud service vulnerability, remediation requires upgrading the client drivers. No alternative mitigations are indicated.