Exploitation ongoing with high activity in latest observed window (1 mentions)
Recommended action window: Immediate (within 24h)
NVD description
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
Priority
MEDIUM
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-07-16 | 2 | Disclosure1Patch1 |
| 2026-07-17 | 1 | Active Exploitation1 |
| 2026-07-20 | 1 | Patch1 |
CVE-2026-15925 Improper TLS Hostname Verification in Snowflake Connector for Python Below 4.7.1 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-15925
Post summary
The post discloses CVE‑2026‑15925, highlighting an improper TLS hostname verification flaw in Snowflake’s Python connector versions below 4.7.1, with no evidence of exploitation or patch details.
⚠️ Linux Red Hat OpenShift AI (RHOAI) alert: CVE-2026-15925 (CVSS 7.4) Attackers could access sensitive information. Upgrade to a vendor-listed fixed release. https://vulnipulse.com/advisories/linux-cve-2026-15925 #Linux #RedHatOpenShiftAIRHOAI #CyberSecurity #CVE
Post summary
The tweet alerts to CVE-2026-15925, highlights its CVSS 7.4 rating, urges upgrading to a vendor‑listed fix, but offers no PoC or active exploitation details.
Our CTI team identified a lot of activities targeting Snowflake Connector for Python (CVE-2026-15925) https://vuldb.com/vuln/379480/cti
Post summary
CTI analysts report widespread attacker activity against Snowflake Connector for Python CVE‑2026‑15925, indicating ongoing exploitation in the wild.
🚨 CRITICAL - TLS hostname verification bypass in Snowflake Connector for Python (CVE-2026-15925) Snowflake Connector for Python contains improper TLS hostname verification that can fail to correctly validate the certificate hostname for HTTPS connections made by the connector. The root cause is improper certificate/hostname validation (TLS verification bypass) during connection setup. An on-path attacker (MITM), able to intercept or redirect network traffic, can present a trusted-CA-signed certificate for a different domain and still have the connection accepted, with no elevated privileges required beyond network positioning. Impact includes credential theft, exposure of query results and staged file contents, and potential arbitrary SQL execution within the victim’s connector session. 👉 Affected: snowflake-connector-python < 4.7.1 | Upgrade to 4.7.1
Post summary
Snowflake Connector for Python has a TLS hostname verification bypass (CVE‑2026‑15925) that enables MITM attackers to steal credentials and execute arbitrary SQL. The vulnerability is mitigated by upgrading to snowflake-connector‑python 4.7.1.