Snowflake Drivers CVE-2026-85525

Successful exploitation requires two simultaneous and non-trivial conditions: (1) the attacker must hold a network on-path position between the Snowflake driver host and a Snowflake service or storage-stage hostname - this could be achieved via ARP poisoning on a local network, BGP hijacking, a compromised cloud NAT or proxy, or a malicious Wi-Fi access point; and (2) the attacker must possess a TLS certificate that was previously issued for the target Snowflake or stage hostname and has since been revoked, along with the corresponding private key - this implies a prior CA compromise, certificate theft, or an attacker who originally held a legitimate cert that was later revoked. Non-default or degraded network path conditions are required; a remote attacker with no on-path capability cannot exploit this vulnerability. Exploitation is further limited to data within the intercepted TLS session; it does not grant persistent access, account compromise, or access to data outside the intercepted connection window. There is no user interaction component - exploitation is transparent to end users and pipeline operators once the MITM position is established.

Real-world risk is moderate-to-high for organizations transmitting sensitive data through Snowflake drivers but is substantially constrained by the attack prerequisites. The CVSS 7.4 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N) accurately captures that exploitation is network-reachable and unauthenticated against the driver but requires high complexity: the attacker must simultaneously hold an on-path network position between a client host and Snowflake infrastructure AND possess a revoked certificate with its private key for a Snowflake or stage hostname - the latter is a particularly steep bar, as it presupposes either a compromised CA, a stolen cert whose compromise was later discovered and revoked, or a rogue CA trusted by the driver. EPSS data was not provided, limiting probabilistic exploitation assessment; no KEV listing and no public exploit code further reduce urgency relative to the raw CVSS score. However, the data impact when exploitation succeeds is severe: an attacker positioned mid-session can read all query results, credentials, and data exfiltrated to/from Snowflake stages, as well as inject malicious query results or stage content. Soft-fail OCSP behavior is a known widespread pattern (per RFC 6960 debates), meaning this class of bug is not exotic. Organizations running automated pipelines where a developer or CI system blindly trusts the driver's OCSP verdict face elevated risk.

An attacker who has compromised a network segment traversed by a data pipeline host connecting to Snowflake (e.g., an internal router, cloud NAT gateway, or BGP peer) and who has also acquired a revoked TLS certificate with private key for a Snowflake endpoint hostname intercepts the TLS handshake from a driver host. The driver's OCSP check either consults a misbound cached response or encounters a soft-fail condition, accepts the revoked cert, and completes the TLS session with the attacker's endpoint. The attacker then forwards queries upstream to Snowflake while reading all response payloads, exfiltrating query results, credentials, and stage file contents. No public proof-of-concept code was identified at time of analysis.