Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15925— Improper TLS Hostname Verification in Snowflake Connector for Python

Quick assessment

Affected
Snowflake Snowflake Connector for Python
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snowflake Snowflake Connector for Python是美国Snowflake公司的一款连接Snowflake数据库的Python客户端。 Snowflake Connector for Python 3.18.1之前版本和4.7.1之前版本存在加密问题漏洞，该漏洞源于TLS主机名验证不当，可能导致网络位置的攻击者通过拦截或重定向网络流量，出示任何受信任CA为任何域名签名的证书，绕过连接器的HTTPS证书主机名验证，造成连接器接受连接而未验证证书是否与请求的主机名匹配。成功利用需

AI Predicted 5.9 Difficulty: Moderate EPSS 0.29% · P20

Affected Version Matrix 2

VendorProduct Version RangeStatus
Snowflake Snowflake Connector for Python 3.17.4< 3.18.1 affected
4.0.0< 4.7.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15925

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Improper TLS Hostname Verification in Snowflake Connector for Python
Source: CVE Program / CVE List V5
Vulnerability Description
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对宿主不匹配的证书验证不恰当
Source: CVE Program / CVE List V5
Vulnerability Title
Snowflake Connector for Python 加密问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snowflake Snowflake Connector for Python是美国Snowflake公司的一款连接Snowflake数据库的Python客户端。 Snowflake Connector for Python 3.18.1之前版本和4.7.1之前版本存在加密问题漏洞，该漏洞源于TLS主机名验证不当，可能导致网络位置的攻击者通过拦截或重定向网络流量，出示任何受信任CA为任何域名签名的证书，绕过连接器的HTTPS证书主机名验证，造成连接器接受连接而未验证证书是否与请求的主机名匹配。成功利用需
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Snowflake Snowflake Connector for Python 3.17.4 ~ 3.18.1 -

II. Public POCs for CVE-2026-15925

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-15925

请登录查看更多情报信息。

Vendor Pages for CVE-2026-15925 (1)

IV. Related Vulnerabilities

Same product: Snowflake Connector for Python
Same vendor: Snowflake
Same weakness: CWE-297

V. Comments for CVE-2026-15925

No comments yet

Leave a comment