AIKIDO-2026-572073

TL;DR

The connector substitutes the standard library ssl.SSLContext with a PyOpenSSLContext when wrapping sockets, and in the affected versions that substitution accepts the peer certificate without verifying it matches the requested hostname. A network-positioned attacker able to intercept or redirect traffic can present a certificate signed by any trusted CA for any domain and have the connector accept the connection. This exposes credentials, query data, and staged file contents to interception and tampering, and can let the attacker issue arbitrary SQL within the victim's connector session. The fix carries forward TLS version, options, and verification flags from the stdlib context and adds explicit post-handshake hostname verification.