CVE-2026-15183: Input Validation Vulnerabilities in Snowflake Spark Connector
Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An attacker could exploit these vulnerabilities by supplying a crafted OAuth token request URL, placing malicious files in an ingestion pipeline, injecting SQL via staging options in a shared Spark environment , or issuing runtime SET commands in a shared Spark-SQL session to inject arbitrary SQL into the SnowflakeFallbackCatalog's option map, which executes under the cluster admin's JDBC credentials. Successful exploitation may result in credential theft, unauthorized access to Snowflake account data, or privilege escalation within connected infrastructure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
spark-snowflaketo a version that resolves this vulnerability.Fixed in 3.2.1 - Compensating control
If you must use a vulnerable spark-snowflake version, restrict which users/jobs can submit crafted OAuth token request URLs and limit outbound access so OAuth client credentials and COPY destinations cannot be redirected to attacker-controlled endpoints.
- Compensating control
In shared Spark and Spark-SQL environments, prevent untrusted users from creating or issuing runtime SQL/SET commands in shared Spark-SQL sessions that could inject arbitrary SQL into SnowflakeFallbackCatalog's option map under cluster admin JDBC credentials.
- Operational
Rotate any Snowflake OAuth client credentials (and any connector-related secrets) that may have been exposed via exfiltration of OAuth client credentials from successful exploitation.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15183?
CVE-2026-15183 has a critical severity rating of 9.2.
What types of vulnerabilities are present in CVE-2026-15183?
CVE-2026-15183 includes multiple input validation vulnerabilities related to SQL Injection and SSRF.
How do I fix CVE-2026-15183?
To mitigate CVE-2026-15183, upgrade to the Snowflake Spark Connector version 3.2.1 or later.
What impact can CVE-2026-15183 have on my system?
CVE-2026-15183 can lead to exfiltration of OAuth client credentials and unauthorized execution of SQL queries.
Is my Snowflake Spark Connector affected by CVE-2026-15183?
Versions of the Snowflake Spark Connector prior to 3.2.1 are affected by CVE-2026-15183.