Technical impact
The Snowflake Connector for Python contained an improper hostname verification flaw that allowed a network‑positioned attacker to present a valid certificate for any domain without the connector checking that the hostname matched. An attacker could therefore intercept or redirect HTTPS traffic and capture or alter credentials, query data, and staged file contents. Once the connection was established, the attacker could issue arbitrary SQL within the victim’s connector session, constrained only by the privileges of the Snowflake role. Based on the description, it is inferred that the attacker’s ability to issue arbitrary SQL is limited by the privileges of the affected Snowflake role, thereby constraining the potential damage in an individual account.
Affected Systems
All installations of the Snowflake Connector for Python that were using a version older than 4.7.1 or 3.18.1 are affected by this vulnerability.
Risk and Exploitability
The CVSS score of 9.2 indicates a high severity vulnerability. The EPSS score is under 1 %, showing a currently low probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack would require on‑path network access, typically obtained through MITM techniques such as ARP poisoning, DNS spoofing, or BGP hijacking. The required on‑path capability limits the attack to environments where the attacker can position themselves between the connector client and the Snowflake service, but once achieved, the attacker could tamper with traffic and execute SQL commands within the context of the victim's role.
Github GHSA