CVE-2026-85525

Snowflake's Python, Go, JDBC, and Node.js drivers improperly validate OCSP responses: responses were not reliably bound to the certificate being checked, and definitive OCSP verification failures were treated as transient, so a revoked TLS certificate could be accepted as valid (CWE-295/CWE-347). An attacker in an on-path (man-in-the-middle) position who holds a revoked certificate and its private key for a Snowflake or stage hostname can trigger the flaw and cause the driver to complete a TLS session with an attacker-controlled endpoint. The attacker can then read and modify data transmitted within that intercepted connection, with impact limited to that connection; the requirements of on-path access plus possession of the private key are reflected in the high-attack-com complexity CVSS 3.1 score of 7.4 (High). Any environment using the affected Snowflake drivers to connect to Snowflake is affected, and remediation requires a manual upgrade to the patched versions. Exploitation is not currently known: there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS assigns a roughly 0.1% probability of exploitation within 30 days (1st percentile).

What to do: Manually upgrade the Snowflake Python, Go, JDBC, and Node.js drivers to the patched versions identified in Snowflake's advisory (the dataset does not list specific version numbers). Prioritize upgrades for clients running on untrusted or shared networks, since exploitation requires an on-path attacker who also holds the revoked certificate's private key. Audit data pipelines, CI jobs, and BI integrations for embedded driver versions, as the fix is not automatic and requires deliberate upgrades.