CVE-2026-15925
Awaiting Analysis Awaiting Analysis - Queue

Improper TLS Hostname Verification in Snowflake Connector for Python

Publication date: 2026-07-16

Last updated on: 2026-07-16

Assigner: 412d305a-227d-44f9-a262-a31ba44f2aea

Description
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-16
Last Modified
2026-07-16
Generated
2026-08-05
AI Q&A
2026-07-16
EPSS Evaluated
2026-08-04
NVD
CVE-2026-15925
EUVD
EUVD-2026-44869

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snowflake snowflake_connector_for_python to 4.7.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-297 The product communicates with a host that provides a certificate, but the product does not properly ensure that the certificate is actually associated with that host.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Improper TLS hostname verification in Snowflake Connector for Python versions before 4.7.1 allowed a network attacker to bypass certificate validation on HTTPS connections. The attacker could intercept or redirect traffic and present a valid certificate for any domain, causing the connector to accept the connection without verifying the hostname matched the requested domain.

Detection Guidance

Detection involves checking the Snowflake Connector for Python version in use. Run 'pip show snowflake-connector-python' to verify if the version is below 4.7.1. Monitor network traffic for unexpected certificate validations or TLS handshake anomalies.

Impact Analysis

This vulnerability could expose credentials, query data, and staged file contents to interception and tampering. An attacker could also issue arbitrary SQL commands within the victim's connector session, limited only by the privileges of the affected Snowflake role.

Compliance Impact

This vulnerability could lead to unauthorized interception of sensitive data such as credentials, query data, and file contents due to improper TLS hostname verification. This may violate GDPR's data protection requirements for secure transmission and HIPAA's safeguards for protected health information during transmission.

Mitigation Strategies

Upgrade the Snowflake Connector for Python to version 4.7.1 or later immediately. This can be done using 'pip install --upgrade snowflake-connector-python'. Ensure no sensitive data is transmitted until the upgrade is complete.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15925. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart