Description

Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in the patched versions listed above. Users must manually upgrade.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-09-04T09:17:11.610Z",
  "pubdate": "2026-09-04T09:17:11.610Z",
  "executiveSummary": "A critical vulnerability exists within multiple Snowflake drivers—specifically Python, Go, JDBC, and Node.js—stemming from improper Online Certificate Status Protocol (OCSP) response validation. This flaw enables the acceptance of revoked TLS certificates as valid, effectively bypassing certificate revocation checks. The core of the issue lies in the failure to securely bind OCSP responses to the certificate under validation and the misclassification of definitive verification failures as transient errors.\nThe vulnerability carries a significant security risk, as a man-in-the-middle (MITM) attacker possessing a revoked certificate and its corresponding private key for a Snowflake or stage hostname can successfully establish an encrypted TLS session with the driver. This allows the attacker to intercept, read, and manipulate data transmitted over the connection. Successful exploitation is contingent upon the attacker maintaining an on-path network position and possessing the valid private key associated with the revoked certificate. The impact is primarily limited to the specific data transmitted within the compromised TLS stream, though the implications for sensitive data confidentiality and integrity are severe.",
  "technicalDetails": "The vulnerability is rooted in the implementation of the TLS certificate validation logic within the Snowflake driver ecosystem. The drivers failed to ensure that OCSP responses were cryptographically or logically bound to the specific leaf certificate being presented during the TLS handshake. Furthermore, the drivers exhibited flawed error handling logic, where definitive OCSP verification failures (indicating certificate revocation) were erroneously treated as transient network issues. This behavior caused the drivers to fallback or proceed despite failing the revocation status check, which is a critical security failure in TLS validation.\nThe exploitation flow begins with an attacker obtaining a revoked certificate and its associated private key for a target Snowflake or stage hostname. Through an on-path position—such as a compromised gateway, malicious proxy, or DNS poisoning—the attacker intercepts the connection request from a vulnerable Snowflake driver. When the driver initiates a TLS handshake, the attacker presents the revoked certificate. Because the driver fails to perform proper OCSP binding or incorrectly interprets the revocation result as a transient error, the driver accepts the certificate as valid.\nOnce the TLS handshake is successfully completed, the driver establishes an encrypted tunnel directly to an attacker-controlled endpoint. Because the driver believes it is communicating with a legitimate Snowflake service, it proceeds to transmit sensitive data. The attacker, sitting as a transparent proxy, decrypts the traffic using the private key associated with the revoked certificate, allowing for full inspection and modification of the data stream. After potential tampering, the attacker can forward the modified traffic to the legitimate destination or simply capture the information for exfiltration.\nThe scope of this vulnerability affects the Snowflake Python, Go, JDBC, and Node.js drivers. It does not require prior authentication or elevated privileges, as the exploitation occurs at the transport layer during the initial connection setup. Network exposure is high for any client relying on these drivers to connect to Snowflake infrastructure via potentially untrusted or intercepted networks. The lack of strict OCSP enforcement effectively renders the certificate revocation mechanism inert in these specific implementations, allowing attackers to leverage otherwise invalidated credentials to perform effective MITM attacks."
}