Is CVE-2026-85525 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-85525 being exploited in the wild.

How severe is CVE-2026-85525?

High severity, with a CVSS score of 7.4, published 4 September 2026.

Which products and versions are affected?

Snowflake Connector for Python before 4.7.3.

Is there a fix for CVE-2026-85525?

A patch was published on 2026-09-04: Patches released for all affected drivers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-85525 attacked?

It is attacked over the network.

Am I affected by CVE-2026-85525?

Check whether you run Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-85525: Snowflake drivers improper OCSP response validation

CVE-2026-85525 · Severity: high · CVSS 7.4 · Published 2026-09-04

Snowflake's database drivers for Python, Go, JDBC, and Node.js contain a flaw in how they validate TLS certificates through OCSP (Online Certificate Status Protocol). An attacker with network access and possession of a revoked certificate's private key could intercept connections and read or modify data in transit. Exploitation requires specific positioning on the network and access to a private key, but could allow data theft or modification from applications using affected driver versions.

Technologies: Snowflake Connector for Python. Vendors: Snowflake.

Quick answers

Is CVE-2026-85525 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-85525 being exploited in the wild.
How severe is CVE-2026-85525?: High severity, with a CVSS score of 7.4, published 4 September 2026.
Which products and versions are affected?: Snowflake Connector for Python before 4.7.3.
Is there a fix for CVE-2026-85525?: A patch was published on 2026-09-04: Patches released for all affected drivers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-85525 attacked?: It is attacked over the network.
Am I affected by CVE-2026-85525?: Check whether you run Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability lies in improper OCSP response validation within Snowflake's database drivers: OCSP responses were not reliably bound to the certificate being validated, and definitive verification failures were treated as transient errors. This allows a man-in-the-middle attacker holding a revoked TLS certificate and its private key to establish a connection that the driver accepts as valid. The attack requires on-path positioning (network interception capability) and possession of the private key material. Successful exploitation allows reading and modification of data within the intercepted TLS connection. Patches are available: Snowflake Connector for Python v4.7.3+, Go Driver v2.2.0+, JDBC Driver v4.3.4+ (including fips and thin variants), and Node.js Driver v3.3.0+.

Affected products

Snowflake Connector for Python before 4.7.3
Snowflake Go Driver before 2.2.0
Snowflake JDBC Driver before 4.3.4
Snowflake Node.js Driver before 3.3.0

Timeline

2026-09-04: disclosed
2026-09-04: patched: Patches released for all affected drivers

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.