External risk intelligence

Snowflake Connector for Python Improper TLS Hostname Verification

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-15925

This is a client-side library used by developers within applications to connect to a service. It is not an internet-facing service, appliance, or gateway itself. The vulnerability requires a specific, active on-path network interception, which is not a characteristic of standard internet-facing deployment patterns.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

Improper TLS hostname verification in the Snowflake Connector for Python could allow an attacker with network access to intercept and tamper with data, including credentials and query results, by presenting a forged certificate. This could enable an attacker to execute arbitrary SQL commands within a compromised session, with the impact limited by the privileges of the affected Snowflake role.

Connectors can be tricked by forged certificates.
Prevents sensitive data interception and unauthorized commands.
Confirm connector relevance and check for exposure.

Attack Path

How an attacker could exploit the issue

An attacker positioned on the network could exploit this vulnerability by intercepting or redirecting traffic, then presenting a fake but trusted certificate to the Snowflake Connector for Python. This would trick the connector into accepting the malicious connection without verifying the hostname, potentially exposing sensitive data or allowing unauthorized commands.

Requires on-path network access.
Triggers on HTTPS connection establishment.
Exposes data and allows command injection.

Live Threat

Current exploitation, exposure, and threat context

Improper TLS hostname verification in the Snowflake Connector for Python could allow a network-positioned attacker to bypass certificate validation and accept connections to unauthorized servers. When supported by an on-path network interception capability, this could expose credentials, query data, and staged file contents to interception and tampering, and enable the attacker to issue arbitrary SQL commands.

Credentials and query data at risk.
On-path network interception by attacker.
Interception, tampering, and SQL injection.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Snowflake Connector for Python is a client-side library, meaning ownership likely resides with application development teams or those responsible for managing data pipelines that utilize Snowflake. The first practical step involves identifying all applications and scripts using the connector, assessing their business criticality, and understanding their network exposure to confirm the need for immediate action.

Application teams own the issue.
Verify affected application reachability.
Plan manual connector upgrades.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Snowflake Connector for Python?

It is a client-side library developers integrate into their own Python applications and data pipelines. It acts as the bridge that allows these programs to communicate securely with Snowflake services, enabling them to execute queries, manage data, and handle file transfers programmatically.

How does CVE-2026-15925 work?

This vulnerability falls under the weakness class of improper validation of certificate contents. When the connector initiates an HTTPS connection, it fails to verify that the server's TLS certificate actually matches the expected hostname. Because this check is skipped, the software might trust a fraudulent certificate presented by an attacker, effectively bypassing the encryption's goal of ensuring you are talking to the legitimate Snowflake service.

Do I need an active network presence to trigger this bug?

Yes. An attacker must have the ability to intercept or redirect your network traffic, such as through ARP spoofing or malicious proxies. Simply connecting to the internet does not trigger this flaw. If the connection is not being actively tampered with by an entity positioned between your application and the legitimate server, the vulnerability does not manifest.

Is my application at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this is a client-side library rather than an internet-facing gateway or appliance. Because it requires a specific, active on-path network interception to exploit, it is considered unlikely to be a direct target compared to services exposed at the network perimeter. However, risk remains if your environment is susceptible to man-in-the-middle network attacks.

When should I update my software?

You should plan to upgrade immediately by identifying all internal scripts and applications that utilize versions of the Snowflake Connector for Python prior to 4.7.1. Since this is a library, the fix must be applied manually by updating your project's dependencies to version 4.7.1 or later to ensure proper hostname validation is enforced.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.