The Snowflake Python, Go, JDBC, and Node.js drivers do not properly validate OCSP responses. A revoked TLS certificate can be accepted as valid because the OCSP response is not bound to the certificate and definitive validation failures are considered transient. A man‑in‑the‑middle attacker possessing a revoked certificate and its private key for a Snowflake or stage hostname could trick the driver into opening a TLS session to read and alter the data transmitted in that connection. The vulnerability is an OCSP validation weakness that permits data exfiltration or tampering.

Snowflake Connector for Python, Snowflake Go Driver, Snowflake JDBC Driver, and Snowflake Node.js Driver. All releases prior to the patched versions announced in the Snowflake documentation (e.g., the Python driver v4.7.3 and the corresponding releases for Go, JDBC, and Node.js).

The CVSS score is 7.4, indicating a high severity. The EPSS score of 0.00105 indicates a very low probability of exploitation, though the vulnerability is still active and not listed in the CISA KEV catalog. Exploitation requires that the attacker be on the network path and possess a revoked certificate and its private key for the Snowflake or stage hostname data carried within the intercepted connection, but it enables data exfiltration and tampering. The attacker can therefore read and alter traffic, potentially compromising confidential information, without executing arbitrary code on the client or Snowflake servers.