Answer in brief
CVE-2026-15925 records a Critical severity (CVSS 9.2) vulnerability in Improper TLS Hostname Verification in Snowflake Connector for Python. The current sources do not mark it as known exploited. The current feed maps Snowflake/Snowflake Connector for Python (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Snowflake/Snowflake Connector for Python (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Snowflake/Snowflake Connector for Pythongeneric | >=3.17.4 <3.18.1 || >=4.0.0 <4.7.1 | 3.18.1, 4.7.1 |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 16, 2026
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-15925 records a Critical severity (CVSS 9.2) vulnerability in Improper TLS Hostname Verification in Snowflake Connector for Python. The current sources do not mark it as known exploited. The current feed maps Snowflake/Snowflake Connector for Python (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.2. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Snowflake/Snowflake Connector for Python (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Snowflake/Snowflake Connector for Pythongeneric | >=3.17.4 <3.18.1 || >=4.0.0 <4.7.1 | 3.18.1, 4.7.1 |
Published upstream
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jul 16, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 16, 2026
Improper TLS hostname verification in Snowflake Connector for Python versions prior to 4.7.1 and 3.18.1 may have allowed a network-positioned attacker to bypass certificate hostname validation on HTTPS connections made by the connector. An attacker with on-path network access could exploit this by intercepting or redirecting network traffic and presenting a certificate signed by any trusted CA for any domain, causing the connector to accept connections without validating that the certificate matched the requested hostname. Successful exploitation requires an on-path traffic interception capability (e.g. ARP/DNS poisoning, rogue access point, BGP hijacking, or malicious proxy/exit node). This vulnerability may have exposed credentials, query data, and staged file contents to interception and tampering, and may have enabled the attacker to issue arbitrary SQL within the context of the victim's connector session. Impact is limited by the privileges of the affected Snowflake role. The fix is available in Snowflake Connector for Python versions 4.7.1 and 3.18.1. Users must manually upgrade.
Quoted source text, attributed separately from HOL analysis.