Executive brief
The Snowflake Connector for Python is a library that connects Python applications to Snowflake databases for executing queries and managing data. A flaw in TLS certificate validation could allow an attacker positioned on the network (e.g., at a router, wifi access point, or ISP) to intercept encrypted connections by presenting fraudulent certificates, potentially exposing database credentials, query results, and sensitive data in transit. An attacker could also inject malicious SQL commands into the session.
Technical details
This vulnerability is an improper TLS certificate hostname verification issue (CWE-297). The Snowflake Connector for Python failed to validate that the hostname in an HTTPS certificate matched the hostname being connected to, allowing certificate substitution attacks. An attacker with network-level access (on-path capability such as ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy) can intercept traffic and present a valid certificate from any trusted CA for any domain, and the connector would accept it without validation. No user interaction or authentication is required. Successful exploitation exposes connection credentials, query data, staged file contents, and allows arbitrary SQL injection within the victim's Snowflake session context. Impact is limited by the Snowflake role privileges. Patches are available in versions 4.7.1 and 3.18.1; users must manually upgrade.
Affected products
- Snowflake Connector for Python < 3.18.1, >= 4.0.0 and < 4.7.1
Timeline
- 2026-07-16: disclosed: Vulnerability disclosed to GitHub Advisory Database
- 2026-07-15: patched: Patches released in versions 3.18.1 and 4.7.1