CVE-2026-15925

Executive Summary

CVE-2026-15925 is a critical vulnerability in the Snowflake Connector for Python (versions prior to 4.7.1) that allows a network-positioned attacker to bypass TLS hostname verification. This flaw enables an attacker with on-path network access (e.g., via ARP/DNS poisoning, rogue access points, BGP hijacking, or malicious proxy/exit nodes) to intercept HTTPS connections, present a certificate signed by any trusted CA for any domain, and have the connector accept the connection without validating that the certificate matches the requested hostname. Successful exploitation can lead to the interception and tampering of credentials, query data, and staged file contents, as well as the ability to issue arbitrary SQL commands within the context of the victim's Snowflake session. The impact is limited by the privileges of the affected Snowflake role. The fix is available in version 4.7.1, and users must manually upgrade.

Supply Chain & Package Security

This vulnerability affects the Snowflake Connector for Python, a PyPI package (snowflake-connector-python). Organizations using this package in their data pipelines, ETL processes, or analytics workflows are at risk. The supply chain risk is significant because the connector is a trusted component that handles sensitive credentials and data. An attacker who compromises the network path can exploit this flaw to gain unauthorized access to Snowflake instances, potentially leading to data exfiltration, manipulation, or lateral movement within the cloud environment. Users must verify their installed version and upgrade immediately to mitigate supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector (AV): Network (N) – The attack is executed over the network.
• Attack Complexity (AC): High (H) – The attacker requires on-path network access, which is not trivial but achievable in many environments.
• Privileges Required (PR): None (N) – No authentication is needed to exploit the vulnerability.
• User Interaction (UI): None (N) – The victim does not need to perform any action beyond normal usage.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Credentials, query data, and file contents can be exposed.
• Integrity (I): High (H) – Data can be tampered with, and arbitrary SQL can be executed.
• Availability (A): High (H) – The attacker could disrupt or manipulate data flows.

Threat Level: High. The vulnerability is exploitable by a determined attacker with network access, and the potential impact on data confidentiality, integrity, and availability is severe.

Deep Dive & Mechanics

The vulnerability lies in the TLS hostname verification logic of the Snowflake Connector for Python. When establishing an HTTPS connection to Snowflake, the connector should verify that the certificate presented by the server matches the hostname being requested. However, due to improper implementation, the connector fails to perform this check correctly. Specifically, the connector may accept any certificate signed by a trusted Certificate Authority (CA) for any domain, without verifying that the certificate's Subject Alternative Name (SAN) or Common Name (CN) matches the intended Snowflake hostname.

Attack Scenario:

1. Precondition: The attacker must be on the network path between the victim and Snowflake (e.g., via ARP spoofing, DNS poisoning, rogue Wi-Fi, or compromised proxy).
2. Interception: The attacker intercepts the victim's HTTPS connection to Snowflake.
3. Certificate Presentation: The attacker presents a valid certificate (signed by a trusted CA) for a domain they control (e.g., attacker.com), or a certificate that is otherwise trusted but does not match the Snowflake hostname.
4. Bypass: The connector accepts the connection because it does not validate that the certificate's hostname matches the requested Snowflake hostname.
5. Exploitation: The attacker can now decrypt, read, and modify all traffic, including credentials, SQL queries, and file uploads/downloads. They can also inject arbitrary SQL commands.

Root Cause: The connector likely uses a custom or misconfigured TLS verification routine that omits the hostname check, or it relies on a library that does not enforce hostname verification by default.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.7.1): The vulnerable code likely uses a TLS context that does not enforce hostname verification. For example, it might use ssl._create_unverified_context() or a custom context without setting check_hostname=True.

# Vulnerable example (conceptual)
import ssl
import urllib.request

context = ssl._create_unverified_context()  # No hostname verification
# OR
context = ssl.create_default_context()
context.check_hostname = False  # Explicitly disabled

Patched Code (4.7.1+): The patched version ensures that hostname verification is enabled and properly enforced.

# Patched example (conceptual)
import ssl
import urllib.request

context = ssl.create_default_context()
context.check_hostname = True  # Enforce hostname verification
context.verify_mode = ssl.CERT_REQUIRED  # Require valid certificate

Key Difference: The patched code explicitly sets check_hostname=True and verify_mode=ssl.CERT_REQUIRED, ensuring that the certificate's hostname is validated against the requested hostname.

Exploitation & Lab Setup

Red Team (Attacker)

Objective: Intercept and manipulate Snowflake connector traffic.

Lab Setup:

• Victim Machine: Python environment with snowflake-connector-python version < 4.7.1.
• Attacker Machine: Kali Linux or similar, with tools like mitmproxy, bettercap, or arpspoof.
• Network: Both machines on the same subnet (or attacker can perform ARP spoofing).

Steps:

1. Set up ARP spoofing to redirect victim's traffic through the attacker machine.

   arpspoof -i eth0 -t <victim_ip> <gateway_ip>
   arpspoof -i eth0 -t <gateway_ip> <victim_ip>
   

2. Enable IP forwarding on the attacker machine.

   echo 1 > /proc/sys/net/ipv4/ip_forward
   

3. Set up mitmproxy to intercept HTTPS traffic.

   mitmproxy --mode transparent --listen-port 8080
   

4. Configure iptables to redirect traffic to mitmproxy.

   iptables -t nat -A PREROUTING -i eth0 -p tcp --dport 443 -j REDIRECT --to-port 8080
   

5. Generate a valid certificate for a domain you control (e.g., attacker.com) using a trusted CA (or use mitmproxy's built-in CA).
6. Run the victim's Snowflake connector script (e.g., connecting to snowflake.example.com). The attacker's mitmproxy will present the certificate for attacker.com, and the vulnerable connector will accept it.
7. Capture and modify traffic to steal credentials, query data, or inject SQL commands.

Expected Outcome: The attacker successfully intercepts the connection and can read/modify all data.

Blue Team (Defender)

Objective: Detect and prevent exploitation.

Detection Steps:

1. Monitor network traffic for anomalies such as unexpected certificate mismatches or connections to unknown IPs.
2. Check Snowflake connector logs for errors related to TLS handshake failures (though the vulnerability may not produce errors).
3. Use endpoint detection and response (EDR) tools to monitor for processes making unusual TLS connections.
4. Implement network segmentation to limit the ability of attackers to perform ARP/DNS poisoning.
5. Enforce strict TLS policies using tools like sslscan or nmap to verify that only valid certificates are accepted.

Prevention:

• Upgrade immediately to version 4.7.1 or later.
• Use certificate pinning if possible, to ensure only specific certificates are trusted.
• Deploy mutual TLS (mTLS) for additional security.
• Monitor for unauthorized network access (e.g., rogue access points, ARP spoofing).

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unexpected TLS certificates presented for Snowflake hostnames (e.g., certificate CN/SAN does not match *.snowflakecomputing.com).
  • Connections to IP addresses not associated with Snowflake's official infrastructure.
  • ARP cache entries showing unexpected MAC-to-IP mappings (indicating ARP spoofing).
  • DNS responses pointing to suspicious IPs (DNS poisoning).

• Host IOCs:

  • Snowflake connector logs showing successful connections despite certificate warnings (if logging is enabled).
  • Unusual outbound connections from the Snowflake connector process to non-standard ports or IPs.
  • Presence of tools like mitmproxy, bettercap, or arpspoof on the network (attacker-side).

• File IOCs:

  • Modified Snowflake connector configuration files that disable TLS verification (e.g., verify=False in connection strings).
  • Unexpected certificate files in the system's trust store.

Detection Engineering

YARA Rule

rule CVE_2026_15925_Snowflake_Connector_TLS_Bypass {
    meta:
        description = "Detects vulnerable Snowflake Connector for Python versions (< 4.7.1) by checking for missing hostname verification in code"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15925"
        severity = "high"
    strings:
        $s1 = "check_hostname" nocase
        $s2 = "ssl._create_unverified_context" nocase
        $s3 = "verify_mode" nocase
        $s4 = "CERT_NONE" nocase
        $s5 = "snowflake.connector" nocase
    condition:
        ($s5) and (
            ($s1 and #s1 < 2) or
            ($s2) or
            ($s3 and $s4)
        )
}

Sigma Rule

title: CVE-2026-15925 - Snowflake Connector TLS Hostname Verification Bypass
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects network connections from Snowflake Connector for Python that may indicate TLS hostname verification bypass.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15925
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: 'python.exe'
        DestinationPort: 443
        DestinationHostname|endswith: '.snowflakecomputing.com'
    filter:
        - DestinationHostname: '*.snowflakecomputing.com'
    condition: selection and not filter
falsepositives:
    - Legitimate connections to Snowflake with proper TLS verification
level: high

Suricata Rule

alert tls $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-15925 - Snowflake Connector TLS Hostname Verification Bypass"; flow:to_server; tls.cert_subject; content:"CN="; distance:0; pcre:"/CN=[^,]+(?i)(?<!snowflakecomputing\.com)/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Snowflake Connector for Python to version 4.7.1 or later. This is the only complete fix.

   pip install --upgrade snowflake-connector-python
   

2. Verify the upgrade by checking the installed version:

   pip show snowflake-connector-python
   

3. Audit all systems using the connector to ensure they are updated.

Mitigation (if upgrade is not immediately possible):

• Network segmentation: Isolate systems running the connector from untrusted networks.
• Use VPN or private connectivity: Route Snowflake traffic through a trusted VPN or AWS PrivateLink/Azure Private Link to reduce exposure to on-path attacks.
• Enable strict firewall rules: Only allow outbound connections to known Snowflake IP ranges.
• Monitor for ARP/DNS spoofing: Use tools like arpwatch or dnsspoof detection.
• Implement certificate pinning in the application code (if feasible) to restrict trusted certificates.

Long-term Recommendations:

• Adopt a DevSecOps pipeline that includes automated dependency scanning for known vulnerabilities.
• Regularly update all dependencies and monitor for CVEs.
• Use runtime security tools (e.g., Falco, Sysdig) to detect anomalous TLS behavior.
• Conduct penetration testing to identify similar vulnerabilities in other components.

Valters IT
Securing your digital frontier.