CVE-2026-15062: SQL Injection in Snowflake Snowpark Python SDK

Severity: critical (CVSS 9.6 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-08 · updated 2026-10-25
Weakness: CWE-89

Description

SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data.

Affected products

Snowflake Snowpark Python SDK: from 0.1.0 before 1.53.0 — fixed in 1.53.0

How to fix

Upgrade to a fixed version: Snowflake Snowpark Python SDK 1.53.0. Check the vendor advisory for mitigations.

References

https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md

Get alerted when CVE-2026-15062 or the next vulnerability affects your stack