Improper OCSP Response Validation in Snowflake Drivers by Snowflake

CVE-2026-85525

What is CVE-2026-85525?

An issue exists in the Snowflake drivers where improper validation of OCSP responses can lead to the acceptance of a revoked TLS certificate as valid. This vulnerability results from the failure to accurately bind OCSP responses to the certificate being validated. Consequently, if a man-in-the-middle attacker possesses a revoked certificate and its private key for a Snowflake or associated hostname, they can successfully establish a TLS session to an endpoint controlled by them. This allows the attacker to intercept and manipulate data within that connection. Exploitation necessitates an on-path position and the corresponding private key, affecting only data within the intercepted connection. Users are advised to manually upgrade to the patched versions to mitigate this risk.

References