Is CVE-2026-15925 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15925 being exploited in the wild.

How severe is CVE-2026-15925?

Critical severity, with a CVSS score of 4, published 16 July 2026.

Which products and versions are affected?

snowflake-connector-python (PyPI) ECOSYSTEM:introduced=0,fixed=3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1,introduced=4.0.0,fixed=4.7.1; Snowflake Connector for Python = 4.0.0 and < 4.7.1; Snowflake Connector for Python < 4.7.1.

Is there a fix for CVE-2026-15925?

Yes. snowflake-connector-python (PyPI): upgrade to 3.18.1, 4.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-15925 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15925?

Check whether you run snowflake-connector-python (PyPI), Snowflake Connector for Python or Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15925: Snowflake Connector for Python improper TLS hostname verification

Q: Is there a fix for CVE-2026-15925?

Yes. snowflake-connector-python (PyPI): upgrade to 3.18.1, 4.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-15925 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-15925?

Check whether you run snowflake-connector-python (PyPI), Snowflake Connector for Python or Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15925 · Severity: critical · CVSS 4 · Published 2026-07-16

The Snowflake Connector for Python is a library that connects Python applications to Snowflake databases for executing queries and managing data. A flaw in TLS certificate validation could allow an attacker positioned on the network (e.g., at a router, wifi access point, or ISP) to intercept encrypted connections by presenting fraudulent certificates, potentially exposing database credentials, query results, and sensitive data in transit. An attacker could also inject malicious SQL commands into the session.

Technologies: snowflake-connector-python (PyPI), Snowflake Connector for Python. Vendors: PyPI, Snowflake.

Quick answers

Is CVE-2026-15925 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15925 being exploited in the wild.
How severe is CVE-2026-15925?: Critical severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?: snowflake-connector-python (PyPI) ECOSYSTEM:introduced=0,fixed=3.18.1, ECOSYSTEM:introduced=0,fixed=3.18.1,introduced=4.0.0,fixed=4.7.1; Snowflake Connector for Python < 3.18.1, >= 4.0.0 and < 4.7.1; Snowflake Connector for Python < 4.7.1.
Is there a fix for CVE-2026-15925?: Yes. snowflake-connector-python (PyPI): upgrade to 3.18.1, 4.7.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-15925 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15925?: Check whether you run snowflake-connector-python (PyPI), Snowflake Connector for Python or Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

snowflake-connector-python (PyPI): upgrade to 3.18.1, 4.7.1 or later
```
pip install "snowflake-connector-python>=4.7.1"
```

Technical details

This vulnerability is an improper TLS certificate hostname verification issue (CWE-297). The Snowflake Connector for Python failed to validate that the hostname in an HTTPS certificate matched the hostname being connected to, allowing certificate substitution attacks. An attacker with network-level access (on-path capability such as ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy) can intercept traffic and present a valid certificate from any trusted CA for any domain, and the connector would accept it without validation. No user interaction or authentication is required. Successful exploitation exposes connection credentials, query data, staged file contents, and allows arbitrary SQL injection within the victim's Snowflake session context. Impact is limited by the Snowflake role privileges. Patches are available in versions 4.7.1 and 3.18.1; users must manually upgrade.

Affected products

Snowflake Connector for Python < 3.18.1, >= 4.0.0 and < 4.7.1

Identifiers

CVE-2026-15925
GHSA-5cc2-282f-jjq2
PYSEC-2026-3920

Timeline

2026-07-16: disclosed: Vulnerability disclosed to GitHub Advisory Database
2026-07-15: patched: Patches released in versions 3.18.1 and 4.7.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.