# CVE-2026-85525: Snowflake drivers improper OCSP response validation

Source: https://junglewise.ai/threats/cve-2026-85525-snowflake-drivers-improper-ocsp-response-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85525 · Severity: high · CVSS 7.4 · Published 2026-09-04

Snowflake's database drivers for Python, Go, JDBC, and Node.js contain a flaw in how they validate TLS certificates through OCSP (Online Certificate Status Protocol). An attacker with network access and possession of a revoked certificate's private key could intercept connections and read or modify data in transit. Exploitation requires specific positioning on the network and access to a private key, but could allow data theft or modification from applications using affected driver versions.

Technologies: [Snowflake Connector for Python](https://junglewise.ai/threats/technologies/connector-for-python). Vendors: [Snowflake](https://junglewise.ai/threats/vendors/snowflake).

## Quick answers

**Is CVE-2026-85525 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85525 being exploited in the wild.

**How severe is CVE-2026-85525?** High severity, with a CVSS score of 7.4, published 4 September 2026.

**Which products and versions are affected?** Snowflake Connector for Python before 4.7.3.

**Is there a fix for CVE-2026-85525?** A patch was published on 2026-09-04: Patches released for all affected drivers Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85525 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85525?** Check whether you run Snowflake Connector for Python at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability lies in improper OCSP response validation within Snowflake's database drivers: OCSP responses were not reliably bound to the certificate being validated, and definitive verification failures were treated as transient errors. This allows a man-in-the-middle attacker holding a revoked TLS certificate and its private key to establish a connection that the driver accepts as valid. The attack requires on-path positioning (network interception capability) and possession of the private key material. Successful exploitation allows reading and modification of data within the intercepted TLS connection. Patches are available: Snowflake Connector for Python v4.7.3+, Go Driver v2.2.0+, JDBC Driver v4.3.4+ (including fips and thin variants), and Node.js Driver v3.3.0+.

## Affected products

- Snowflake Connector for Python before 4.7.3
- Snowflake Go Driver before 2.2.0
- Snowflake JDBC Driver before 4.3.4
- Snowflake Node.js Driver before 3.3.0

## Timeline

- 2026-09-04: disclosed
- 2026-09-04: patched: Patches released for all affected drivers

## References

- [https://pypi.org/](https://pypi.org/)
- [https://pkg.go.dev/](https://pkg.go.dev/)

## Related threats

- [Snowflake Connector for Python SQL injection in write_pandas()](https://junglewise.ai/threats/cve-2026-123859-when-identifier-escaping-is-disabled-through-a-non-default)
- [Snowflake client drivers CORS and CSRF in externalbrowser SSO](https://junglewise.ai/threats/cve-2026-114456-multiple-snowflake-client-drivers-implementing-the-authenticator)
- [Snowflake drivers sensitive information insertion in logs](https://junglewise.ai/threats/cve-2026-86597-snowflake-drivers-sensitive-information-insertion-in-logs)
- [Snowflake Connector for Python improper TLS hostname verification](https://junglewise.ai/threats/cve-2026-15925-snowflake-connector-for-python-improper-tls-hostname-verification)
- [Snowflake Connector for Python SQL injection in write_pandas](https://junglewise.ai/threats/cve-2025-24793-snowflake-connector-for-python-sql-injection-in-write-pandas)