PT-2026-60425 · Snowflake · Snowflake Connector For Python

CVE-2026-15925 · Published 2026-07-16 · Updated 2026-07-16

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Critical

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Snowflake Connector for Python versions prior to 4.7.1 Snowflake Connector for Python versions prior to 3.18.1

Description Improper TLS hostname verification allows a network-positioned attacker to bypass certificate hostname validation on HTTPS connections. An attacker with on-path network access can intercept or redirect traffic and present a certificate signed by any trusted CA for any domain, leading the connector to accept the connection without verifying if the certificate matches the requested hostname. This requires on-path traffic interception capabilities such as ARP/DNS poisoning, rogue access points, BGP hijacking, or malicious proxies. This issue may expose credentials, query data, and staged file contents to interception and tampering, and could allow the attacker to execute arbitrary SQL within the victim's connector session, limited by the privileges of the affected Snowflake role.

Recommendations Upgrade to version 4.7.1. Upgrade to version 3.18.1.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

CVE-2026-15925

Affected Products

Snowflake Connector For Python

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-15925 · Security Note
• https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.1 · Note
• https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.18.1 · Note
• https://twitter.com/UpwindMDR/status/2077698650860400749 · Twitter Post
• https://twitter.com/VulmonFeeds/status/2077667224559481008 · Twitter Post