Read the docs
TI-2026-12787 Aliases CVE-2026-15183GHSA-33r9-fx8q-w69h

Input Validation Vulnerabilities in Snowflake Spark Connector

Priority MEDIUM 41CWE-441Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An attacker could exploit these vulnerabilities by supplying a crafted OAuth token request URL, placing malicious files in an ingestion pipeline, injecting SQL via staging options in a shared Spark environment , or issuing runtime SET commands in a shared Spark-SQL session to inject arbitrary SQL into the SnowflakeFallbackCatalog's option map, which executes under the cluster admin's JDBC credentials. Successful exploitation may result in credential theft, unauthorized access to Snowflake account data, or privilege escalation within connected infrastructure.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00314 24th percentileScored 2026-11-07
Fix Fixed Snowflake Spark Connector (Snowflake): 3.2.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SnowflakeSnowflake Spark Connector0.1.0 to before 3.2.13.2.1Patch availableCNA
  • Snowflake Spark Connector VendorSnowflake Affected 0.1.0 to before 3.2.1 Fixed in 3.2.1 Patch available CNA

Remediation

  • Fix · CNA Snowflake Spark Connector (Snowflake) Fixed in 3.2.1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-15183
  2. 2026-10-03 Alias added: GHSA-33r9-fx8q-w69h

References

Other 1

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences