Read the docs
TI-2026-58680 Aliases CVE-2026-85525GHSA-h6vc-8q8q-7wvw

Improper OCSP response validation in Snowflake drivers

Priority LOW 34CWE-295Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Spoofing, Security bypass
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-295 and CWE-347.

Summary

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00162 5th percentileScored 2026-11-07
Fix Fixed Snowflake Connector for Python (Snowflake): 4.7.3Snowflake Go Driver (Snowflake): 2.2.0+4 more productsRed Hat: 3 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SnowflakeSnowflake Connector for Pythonbefore 4.7.34.7.3Patch availableCNA
SnowflakeSnowflake Go Driverup to 1.19.1—No fix listedCNA
SnowflakeSnowflake Go Driver2.0.0 to before 2.2.02.2.0Patch availableCNA
SnowflakeSnowflake JDBC Driverbefore 4.3.44.3.4Patch availableCNA
SnowflakeSnowflake JDBC Driver (FIPS)before 4.3.44.3.4Patch availableCNA
SnowflakeSnowflake JDBC Driver (Thin)before 4.3.44.3.4Patch availableCNA
SnowflakeSnowflake Node.js Driverbefore 3.3.03.3.0Patch availableCNA
  • Snowflake Connector for Python VendorSnowflake Affected before 4.7.3 Fixed in 4.7.3 Patch available CNA
  • Snowflake Go Driver VendorSnowflake Affected up to 1.19.1 Fixed in — No fix listed CNA
  • Snowflake Go Driver VendorSnowflake Affected 2.0.0 to before 2.2.0 Fixed in 2.2.0 Patch available CNA
  • Snowflake JDBC Driver VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
  • Snowflake JDBC Driver (FIPS) VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
  • Snowflake JDBC Driver (Thin) VendorSnowflake Affected before 4.3.4 Fixed in 4.3.4 Patch available CNA
  • Snowflake Node.js Driver VendorSnowflake Affected before 3.3.0 Fixed in 3.3.0 Patch available CNA

Remediation

  • Fix · CNA Snowflake Connector for Python (Snowflake) Fixed in 4.7.3
  • Fix · CNA Snowflake Go Driver (Snowflake) Fixed in 2.2.0
  • Fix · CNA Snowflake JDBC Driver (Snowflake) Fixed in 4.3.4
  • Fix · CNA Snowflake JDBC Driver (FIPS) (Snowflake) Fixed in 4.3.4
  • Fix · CNA Snowflake JDBC Driver (Thin) (Snowflake) Fixed in 4.3.4
  • Fix · CNA Snowflake Node.js Driver (Snowflake) Fixed in 3.3.0

Red Hat 3 advisories

  • RHSA-2026:92510 Released 2026-10-29 · Red Hat rating Critical
    RHOAI 3.4.6 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:87410 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 2.25.12 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9 +47
  • RHSA-2026:86891 Released 2026-10-21 · Red Hat rating Critical
    RHOAI 3.5.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.5 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-cli-rhel9 +47

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Snowflake JDBC Driver, Snowflake JDBC Driver (FIPS), Snowflake JDBC Driver (Thin) 4.3.4

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-58682 Snowflake JDBC Driver auto-configuration account validation permits credential redirectionPriority LOW 24
    Show all 2 records →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift AI 2.25Fixed RHSA-2026:87410
Red Hat OpenShift AI 3.4Fixed RHSA-2026:92510
Red Hat OpenShift AI 3.5Fixed RHSA-2026:86891
Not affected: 3 products
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift AI 3.5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-85525
  2. 2026-10-03 Alias added: GHSA-h6vc-8q8q-7wvw
  3. 2026-10-22 Fix available: RHSA-2026:86891 · Red Hat
  4. 2026-10-22 Fix available: RHSA-2026:87410 · Red Hat
  5. 2026-10-23 Fix available: Red Hat OpenShift AI 2.25, Red Hat OpenShift AI 3.5 · Red Hat
  6. 2026-10-30 Fix available: RHSA-2026:92510 · Red Hat
  7. 2026-10-30 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Other 4

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences