Executive brief
Snowflake's database drivers for Python, Go, JDBC, and Node.js contain a flaw in how they validate TLS certificates through OCSP (Online Certificate Status Protocol). An attacker with network access and possession of a revoked certificate's private key could intercept connections and read or modify data in transit. Exploitation requires specific positioning on the network and access to a private key, but could allow data theft or modification from applications using affected driver versions.
Technical details
The vulnerability lies in improper OCSP response validation within Snowflake's database drivers: OCSP responses were not reliably bound to the certificate being validated, and definitive verification failures were treated as transient errors. This allows a man-in-the-middle attacker holding a revoked TLS certificate and its private key to establish a connection that the driver accepts as valid. The attack requires on-path positioning (network interception capability) and possession of the private key material. Successful exploitation allows reading and modification of data within the intercepted TLS connection. Patches are available: Snowflake Connector for Python v4.7.3+, Go Driver v2.2.0+, JDBC Driver v4.3.4+ (including fips and thin variants), and Node.js Driver v3.3.0+.
Affected products
- Snowflake Connector for Python before 4.7.3
- Snowflake Go Driver before 2.2.0
- Snowflake JDBC Driver before 4.3.4
- Snowflake Node.js Driver before 3.3.0
Timeline
- 2026-09-04: disclosed
- 2026-09-04: patched: Patches released for all affected drivers