CVE-2026-85525highCWE-295CWE-347

CVE-2026-85525: high-severity vulnerability in Snowflake Connector for Python

Improper OCSP response validation in Snowflake drivers

Published · Updated

Follow this CVE+ Monitor Snowflake Connector for Python+ Monitor Snowflake JDBC Driver

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.4epss 0.2%
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
Snowflake · Snowflake Connector for PythonSnowflake · Snowflake Go DriverSnowflake · Snowflake JDBC DriverSnowflake · Snowflake JDBC Driver (FIPS)Snowflake · Snowflake JDBC Driver (Thin)Snowflake · Snowflake Node.js Driver
Related CVEs — Snowflake Connector for Python

In the same product, most dangerous first.

CVE-2026-86600HIGHWorkload identity attestation generated before login host validation in Snowflake driversEPSS 0.5%CVE-2026-123859HIGHSQL Injection via unescaped DataFrame column names in Snowflake Connector for Python and Snowflake Connector for Python (Universal Core)EPSS 0.4%CVE-2026-85528MEDIUMSnowflake JDBC Driver auto-configuration account validation permits credential redirectionEPSS 0.3%CVE-2026-114456MEDIUMMissing origin validation for the externalbrowser authenticator callback in multiple Snowflake client driversEPSS 0.2%CVE-2026-15925CRITICALImproper TLS Hostname Verification in Snowflake Connector for PythonEPSS 0.2%CVE-2026-86597MEDIUMSensitive information written to logs by Snowflake driversEPSS 0.1%