CVE-2026-15925Critical▾ MidnightSnowflake Connector for Python improperly verifies TLS hostnames
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 52.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
snowflake-connector-python < 3.18.1snowflake-connector-python >= 4.0.0, < 4.7.1Upgrade to a patched release:
snowflake-connector-python 3.18.1snowflake-connector-python 4.7.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-24795Medium· 4.4snowflake-connector-python vulnerable to insecure cache files permissions
CVE-2025-24794Medium· 6.7snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache
CVE-2024-49750Medium· 5.5The Snowflake Connector for Python stores sensitive data in logs
CVE-2025-24793High· 7.0snowflake-connector-python vulnerable to SQL Injection in write_pandas
CVE-2022-42965Medium· 5.9snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)
CVE-2026-85525High· 7.4Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and def…