Read the docs
TI-2026-13340 Aliases CVE-2026-15925GHSA-5cc2-282f-jjq2

Improper TLS Hostname Verification in Snowflake Connector for Python

Priority MEDIUM 47CWE-297Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
High · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00177 7th percentileScored 2026-11-07
Fix Fixed Snowflake Connector for Python (Snowflake): 3.18.1, 4.7.1snowflake-connector-python (PyPI): 3.18.1, 4.7.1Red Hat: 2 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SnowflakeSnowflake Connector for Python3.17.4 to before 3.18.1; 4.0.0 to before 4.7.13.18.1, 4.7.1Patch availableCNA
—snowflake-connector-python (PyPI)before 3.18.13.18.1Patch availableGHSA-5cc2-282f-jjq2
—snowflake-connector-python (PyPI)4.0.0 to before 4.7.14.7.1Patch availableGHSA-5cc2-282f-jjq2
  • Snowflake Connector for Python VendorSnowflake Affected 3.17.4 to before 3.18.1; 4.0.0 to before 4.7.1 Fixed in 3.18.1, 4.7.1 Patch available CNA
  • snowflake-connector-python (PyPI) Vendor— Affected before 3.18.1 Fixed in 3.18.1 Patch available GHSA-5cc2-282f-jjq2
  • snowflake-connector-python (PyPI) Vendor— Affected 4.0.0 to before 4.7.1 Fixed in 4.7.1 Patch available GHSA-5cc2-282f-jjq2

Remediation

  • Fix · CNA Snowflake Connector for Python (Snowflake) Fixed in 3.18.1, 4.7.1
  • Fix · GHSA-5cc2-282f-jjq2 snowflake-connector-python (PyPI) Fixed in 3.18.1 Advisory →
  • Fix · GHSA-5cc2-282f-jjq2 snowflake-connector-python (PyPI) Fixed in 4.7.1 Advisory →

Red Hat 2 advisories

  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 2 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15925
  2. 2026-10-03 Alias added: GHSA-5cc2-282f-jjq2
  3. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  4. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
  5. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  6. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25 · Red Hat

References

Advisory 1

Other 4

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17067 Snowflake Golang Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences