CVE-2026-85525
Received Received - Intake

Improper OCSP Validation in Snowflake Drivers

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: SNOWFLAKE

Description
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in the patched versions listed above. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85525
EUVD
EUVD-2026-70972

Affected Vendors & Products

Showing 8 associated CPEs
Vendor Product Version / Range
snowflake snowflake_python From patched (inc)
snowflake snowflake_go From patched (inc)
snowflake snowflake_jdbc From patched (inc)
snowflake snowflake_node.js From patched (inc)
snowflake snowflake_connector_python 4.7.3
snowflake snowflake_go_driver 2.2.0
snowflake snowflake_jdbc_driver From 4.3.0 (inc) to 4.3.4 (inc)
snowflake snowflake_nodejs_driver From 3.1.0 (inc) to 3.3.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-347 The product does not verify, or incorrectly verifies, the cryptographic signature for data.
CWE-295 The product does not validate, or incorrectly validates, a certificate.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper validation of OCSP responses in Snowflake's Python, Go, JDBC, and Node.js drivers. It allowed revoked TLS certificates to be accepted as valid because OCSP responses were not properly bound to the certificate being checked. A man-in-the-middle attacker with a revoked certificate and private key could exploit this to intercept and modify data transmitted over a TLS connection to a Snowflake endpoint.

Detection Guidance

Detecting this vulnerability requires checking if affected Snowflake drivers are installed and verifying their versions. Inspect installed packages for Python, Go, JDBC, or Node.js drivers. For Python, use pip show snowflake-connector-python. For Go, check go list -m github.com/snowflakedb/gosnowflake. For JDBC, verify the driver JAR version. For Node.js, check npm list snowflake-sdk. Ensure versions are updated to patched releases.

Impact Analysis

An attacker could read or alter data within intercepted connections if they are positioned between the client and server and possess the revoked certificate's private key. This could lead to unauthorized data access, data tampering, or information disclosure for any data transmitted during the compromised session.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Snowflake drivers may face compliance violations if data breaches occur due to this issue.

Mitigation Strategies

Upgrade all Snowflake drivers (Python, Go, JDBC, Node.js) to the latest patched versions immediately. Disable OCSP checks temporarily only if necessary using environment variables like SF_DISABLE_OCSP_CHECKS for Go. Monitor network traffic for suspicious TLS connections to Snowflake endpoints. Rotate any potentially exposed credentials or private keys.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85525. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart