---
id: CVE-2026-15925
title: >-
  snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL
  execution and information disclosure via improper TLS hostname ve…
summary: >-
  A flaw was found in Snowflake Connector for Python. A network-positioned
  attacker could exploit improper Transport Layer Security (TLS) hostname
  verification by intercepting network traffic and presenting a fraudulent
  certificate. This cou…
severity: high
cvss: 7.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N'
cvssSource: vendor
cwe: CWE-295
vendor: Red Hat
product: Red Hat OpenShift AI 3.4
affected:
  - openshift_ai 3.4
patched:
  - openshift_ai 3.4
published: '2026-07-16'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T11:09:38+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15925.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-15925.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-15925'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2501255'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-15925'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-15925'
  - url: >-
      https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v4.7.1
  - url: 'https://access.redhat.com/errata/RHSA-2026:84734'
  - url: >-
      https://github.com/snowflakedb/snowflake-connector-python/commit/8969d6dc027092ee868965db022478b6c0fa40a1
  - url: 'https://github.com/snowflakedb/snowflake-connector-python'
  - url: >-
      https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.18.1
  - url: 'https://pypi.org/project/snowflake-connector-python'
  - url: 'https://github.com/advisories/GHSA-5cc2-282f-jjq2'
tags:
  - csaf
  - vex
  - red-hat
  - osv
  - pip
epss: 0.00177
epssPercentile: 0.07202
aliases:
  - GHSA-5cc2-282f-jjq2
  - PYSEC-2026-3920
ecosystem: pip
ingestedAt: '2026-09-02T19:31:22.704Z'
---

## Overview

A flaw was found in Snowflake Connector for Python. A network-positioned attacker could exploit improper Transport Layer Security (TLS) hostname verification by intercepting network traffic and presenting a fraudulent certificate. This could allow the attacker to bypass certificate hostname validation, leading to the acceptance of connections without proper verification. Consequently, this vulnerability may expose sensitive credentials and query data to interception and tampering, and could enable the attacker to execute arbitrary SQL commands within the victim's session.

## Vendor advisories

- **RHSA-2026:84734** · Red Hat · fixed in: Red Hat OpenShift AI 3.4 · released 2026-10-19 · [advisory](https://access.redhat.com/errata/RHSA-2026:84734)

**snowflake-connector-python: Snowflake Connector for Python: Arbitrary SQL execution and information disclosure via improper TLS hostname verification** — rated Important by Red Hat. Released 2026-07-16, updated 2026-10-19.

Fixed:

- Red Hat OpenShift AI 3.4

Not affected:

- Red Hat OpenShift AI 3.4

## Remediation

For Red Hat OpenShift AI 3.4.5 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this errata update:

https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ https://access.redhat.com/errata/RHSA-2026:84734

## Package advisory (CVE-2026-15925)

Affected packages:

- `snowflake-connector-python < 3.18.1`
- `snowflake-connector-python >= 4.0.0, < 4.7.1`

Patched in:

- `snowflake-connector-python 3.18.1`
- `snowflake-connector-python 4.7.1`

Source: https://osv.dev/vulnerability/GHSA-5cc2-282f-jjq2