CVE-2026-85525

Awaiting Analysis Awaiting Analysis - Queue

Improper OCSP Validation in Snowflake Drivers

Publication date: 2026-09-04

Last updated on: 2026-09-10

Assigner: SNOWFLAKE

Description

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-04

Last Modified

2026-09-10

Generated

2026-09-24

AI Q&A

2026-09-04

EPSS Evaluated

2026-09-23

NVD

CVE-2026-85525

EUVD

EUVD-2026-70972

Affected Vendors & Products

Vendor	Product	Version / Range
snowflake	snowflake_python	From patched (inc)
snowflake	snowflake_go	From patched (inc)
snowflake	snowflake_jdbc	From patched (inc)
snowflake	snowflake_node.js	From patched (inc)
snowflake	snowflake_connector_python	4.7.3
snowflake	snowflake_go_driver	2.2.0
snowflake	snowflake_jdbc_driver	From 4.3.0 (inc) to 4.3.4 (inc)
snowflake	snowflake_nodejs_driver	From 3.1.0 (inc) to 3.3.0 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper validation of OCSP responses in Snowflake's Python, Go, JDBC, and Node.js drivers. It allowed revoked TLS certificates to be accepted as valid because OCSP responses were not properly bound to the certificate being checked. A man-in-the-middle attacker with a revoked certificate and private key could exploit this to intercept and modify data transmitted over a TLS connection to a Snowflake endpoint.

Detection Guidance

Detecting this vulnerability requires checking if affected Snowflake drivers are installed and verifying their versions. Inspect installed packages for Python, Go, JDBC, or Node.js drivers. For Python, use pip show snowflake-connector-python. For Go, check go list -m github.com/snowflakedb/gosnowflake. For JDBC, verify the driver JAR version. For Node.js, check npm list snowflake-sdk. Ensure versions are updated to patched releases.

Impact Analysis

An attacker could read or alter data within intercepted connections if they are positioned between the client and server and possess the revoked certificate's private key. This could lead to unauthorized data access, data tampering, or information disclosure for any data transmitted during the compromised session.

Compliance Impact

This vulnerability could lead to unauthorized access or modification of sensitive data, which may violate compliance requirements under GDPR (data protection) and HIPAA (health information privacy). Organizations using affected Snowflake drivers may face compliance violations if data breaches occur due to this issue.

Mitigation Strategies

Upgrade all Snowflake drivers (Python, Go, JDBC, Node.js) to the latest patched versions immediately. Disable OCSP checks temporarily only if necessary using environment variables like SF_DISABLE_OCSP_CHECKS for Go. Monitor network traffic for suspicious TLS connections to Snowflake endpoints. Rotate any potentially exposed credentials or private keys.

Hi! I’m here to help you understand CVE-2026-85525. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70