Skip to content
Fencer Vulns
high 7.4

CVE-2026-85525 json

Improper OCSP response validation in Snowflake drivers

published 2026-09-04 2 mo ago modified 2026-09-10 59 d ago also EUVD-2026-70972

cvss
7.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.2%
EPSS 0.2% chance of exploitation in 30 days, percentile 5%
public exploits
0
none known

Summary

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in Snowflake Connector for Python v4.7.3, Snowflake Go Driver v2.2.0, Snowflake JDBC Driver v4.3.4 (including the snowflake-jdbc-fips and snowflake-jdbc-thin), and Snowflake Node.js Driver v3.3.0. Users must manually upgrade.

Patch / fix

  • Snowflake Snowflake Connector for Python 4.7.3
  • Snowflake Snowflake Go Driver 2.2.0
  • Snowflake Snowflake JDBC Driver 4.3.4
  • Snowflake Snowflake JDBC Driver (FIPS) 4.3.4
  • Snowflake Snowflake JDBC Driver (Thin) 4.3.4
  • Snowflake Snowflake Node.js Driver 3.3.0
  • alloy openSUSE Tumbleweed 1.21.3-1.1

opensuse advisories openSUSE-SU-2026:12446-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-85525 updated cvss 7.4

snowflake-connector-python: github.com/snowflakedb/snowflake-go: snowflake-sdk: net.snowflake/snowflake-jdbc: Snowflake Drivers: Data interception via improper OCSP response validation

  • Red Hat OpenShift AI 2.25 rhoai/odh-feature-server-rhel9 1792148523
    fixed: vendor fix RHSA-2026:87410
  • Red Hat OpenShift AI 3.4 rhoai/odh-feature-server-rhel9 1792685074
    fixed: vendor fix RHSA-2026:92510
  • Red Hat OpenShift AI 3.5 rhoai/odh-feature-server-rhel9 1791864484
    fixed: vendor fix RHSA-2026:86891
  • Red Hat OpenShift AI 2.25 rhoai/odh-rhel9-operator 1792570619, rhoai/odh-vllm-cpu-rhel9 1792018436, rhoai/odh-dashboard-rhel9 1791853525, rhoai/odh-modelmesh-rhel9 1790881700, rhoai/odh-operator-bundle 1792571069, rhoai/odh-vllm-cuda-rhel9 1791358976, +65 more Red Hat OpenShift AI 3.4 rhoai/odh-cli-rhel9 1792722177, rhoai/rhai-cli-rhel9 1792722177, rhoai/odh-automl-rhel9 1792697253, rhoai/odh-mlflow-rhel9 1793002327, rhoai/odh-autorag-rhel9 1793265800, rhoai/odh-trainer-rhel9 1792817113, +99 more Red Hat OpenShift AI 3.5 rhoai/odh-cli-rhel9 1791945905, rhoai/rhai-cli-rhel9 1791945905, rhoai/odh-automl-rhel9 1791916705, rhoai/odh-mlflow-rhel9 1791947857, rhoai/odh-autorag-rhel9 1791903266, rhoai/odh-trainer-rhel9 1791952138, +112 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 mo ago

Exploit prediction

0.16% chance of exploitation in the next 30 days, higher than 5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.4 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected products

  • Snowflake Snowflake Connector for Python
  • Snowflake Snowflake Go Driver
  • Snowflake Snowflake JDBC Driver
  • Snowflake Snowflake JDBC Driver (FIPS)
  • Snowflake Snowflake JDBC Driver (Thin)
  • Snowflake Snowflake Node.js Driver

Classification

Weakness
  • CWE-295 Improper Certificate Validation
  • CWE-347 Improper Verification of Cryptographic Signature

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.