CVE-2026-85525 in Go Driver
Summary
by MITRE • 09/04/2026
Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and definitive verification failures were treated as transient. A man-in-the-middle attacker holding a revoked certificate and its private key for a Snowflake or stage hostname could cause the driver to establish a TLS session to the attacker-controlled endpoint anyway, allowing the attacker to read and modify data transmitted within that connection. Successful exploitation requires that on-path position and the corresponding private key, and impact is limited to data carried within the intercepted connection. The fix is available in the patched versions listed above. Users must manually upgrade.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/04/2026
The vulnerability identified involves a critical flaw in how Snowflake client drivers for Python, Go, JDBC, and Node.js handle Online Certificate Status Protocol (OCSP) responses during Transport Layer Security (TLS) handshake processes. OCSP is an internet protocol used for obtaining the revocation status of an X.509 digital certificate, serving as a primary mechanism to ensure that certificates have not been compromised or revoked by their issuing Certification Authority before establishing secure communications. In this specific instance, the implementation within these drivers failed to properly bind the OCSP response to the specific certificate being validated. This architectural oversight means that the validation logic did not strictly correlate the status update with the exact public key and identity presented during the handshake, creating a gap where revocation checks could be bypassed or misinterpreted.
Furthermore, the driver treated definitive verification failures as transient errors rather than fatal security violations. In standard TLS implementations, if an OCSP check fails definitively—indicating that a certificate is revoked—the connection should be immediately terminated to prevent any data exchange with potentially compromised endpoints. However, due to this flaw, when the system encountered such a failure, it did not abort the session but instead attempted to retry or proceed under the assumption of temporary network issues. This behavior effectively nullifies the security guarantee provided by certificate revocation lists, allowing connections to be established even when the server's identity has been officially invalidated.
The operational impact of this vulnerability is severe for any organization relying on these drivers for secure data transmission. A man-in-the-middle attacker who possesses both an on-path position and the private key corresponding to a revoked Snowflake or stage hostname can exploit this flaw to intercept traffic. By presenting their own certificate, which may have been previously issued but later revoked due to compromise, the attacker can trick the vulnerable driver into accepting it as valid. Once the TLS session is established under these false premises, the attacker gains the ability to read sensitive data transmitted within that connection and potentially modify it without detection. This compromises both confidentiality and integrity of the data in transit, posing significant risks to organizational security posture and regulatory compliance.
This vulnerability aligns with CWE-295 Improper Certificate Validation, specifically regarding failures to correctly validate certificate revocation status, and maps to MITRE ATT&CK technique T1078 Valid Accounts or related network interception tactics where trust is manipulated through compromised credentials. The root cause lies in the failure to enforce strict binding between the OCSP response data structure and the specific certificate object being verified, coupled with an overly permissive error handling strategy that prioritizes connectivity over security verification outcomes.
To mitigate this risk, users must manually upgrade their Snowflake client drivers for Python, Go, JDBC, and Node.js to the patched versions released by Snowflake. The update addresses the underlying logic errors in OCSP response validation and ensures that definitive revocation failures result in immediate connection termination rather than transient retries. Organizations should verify their current driver versions against the official release notes and implement automated patch management processes to ensure timely updates across all environments utilizing these drivers, thereby closing the attack vector for man-in-the-middle exploits relying on revoked certificates.