CVE-2026-15062: SQL Injection in Snowflake Snowpark Python SDK
SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalizepath() sanitizer and inject SQL via DataFrame.tocsv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
snowpark-python (Snowflake Snowpark Python SDK)to a version that resolves this vulnerability.Fixed in 1.53.0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15062?
The severity of CVE-2026-15062 is critical with a CVSS score of 9.6.
How do I fix CVE-2026-15062?
To fix CVE-2026-15062, upgrade to Snowflake Snowpark Python SDK version 1.53.0 or later.
What type of vulnerability is CVE-2026-15062?
CVE-2026-15062 is an SQL injection vulnerability.
Who is affected by CVE-2026-15062?
Authenticated low-privilege users of Snowflake Snowpark Python SDK prior to version 1.53.0 are affected.
What can attackers do with CVE-2026-15062?
Attackers can exploit CVE-2026-15062 to execute unauthorized SQL commands beyond their privilege level.