CVE-2026-15062

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15062", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "state": "PUBLISHED", "assignerShortName": "SNOWFLAKE", "dateReserved": "2026-07-08T14:26:38.459Z", "datePublished": "2026-07-08T14:32:12.165Z", "dateUpdated": "2026-07-08T15:18:02.740Z"}, "containers": {"cna": {"title": "SQL Injection in Snowflake Snowpark Python SDK", "descriptions": [{"lang": "en", "value": "SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data."}], "affected": [{"vendor": "Snowflake", "product": "Snowpark Python SDK", "versions": [{"version": "0.1.0", "lessThan": "1.53.0", "versionType": "semver", "status": "affected"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}], "references": [{"url": "https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md", "name": "Snowpark Python SDK Release Notes"}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-07-08T14:32:12.165Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-08T15:14:28.232574Z", "id": "CVE-2026-15062", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T15:18:02.740Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15062", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "state": "PUBLISHED", "assignerShortName": "SNOWFLAKE", "dateReserved": "2026-07-08T14:26:38.459Z", "datePublished": "2026-07-08T14:32:12.165Z", "dateUpdated": "2026-07-08T15:18:02.740Z"}, "containers": {"cna": {"title": "SQL Injection in Snowflake Snowpark Python SDK", "descriptions": [{"lang": "en", "value": "SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data."}], "affected": [{"vendor": "Snowflake", "product": "Snowpark Python SDK", "versions": [{"version": "0.1.0", "lessThan": "1.53.0", "versionType": "semver", "status": "affected"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"}}], "references": [{"url": "https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md", "name": "Snowpark Python SDK Release Notes"}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-07-08T14:32:12.165Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15062", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-08T15:14:28.232574Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-08T15:14:32.212Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Snowpark Python SDK", "vendor": "Snowflake", "versions": [{"lessThan": "1.53.0", "status": "affected", "version": "0.1.0", "versionType": "semver"}]}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data."}, {"lang": "es", "value": "Las vulnerabilidades de inyecci\u00f3n SQL en el SDK de Python Snowflake Snowpark (snowpark-python) versiones anteriores a la 1.53.0 podr\u00edan permitir a usuarios autenticados con bajos privilegios ejecutar SQL m\u00e1s all\u00e1 de su \u00e1mbito de autorizaci\u00f3n. Un atacante podr\u00eda explotar estas vulnerabilidades incrustando cargas \u00fatiles SQL en nombres de columnas de bases de datos de origen para escalar privilegios a trav\u00e9s de la API DataFrameReader.dbapi() suministrando un par\u00e1metro de ubicaci\u00f3n especialmente dise\u00f1ado a los m\u00e9todos de escritura de DataFrameWriter para redirigir un COPY INTO a una consulta de origen arbitraria, o incluyendo una secuencia de barra invertida-comilla simple en una ruta de exportaci\u00f3n para eludir el saneador normalize_path() e inyectar SQL a trav\u00e9s de DataFrame.to_csv(). La explotaci\u00f3n exitosa podr\u00eda resultar en el compromiso de la base de datos de origen, la exfiltraci\u00f3n de datos no autorizada entre inquilinos o la lectura no autorizada de datos de la cuenta de Snowflake."}], "id": "CVE-2026-15062", "lastModified": "2026-10-25T20:10:00.147", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 9.6, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 5.8, "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15062", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-08T15:14:28.232574Z", "version": "2.0.3"}}]}, "published": "2026-07-08T15:16:26.320", "references": [{"source": "412d305a-227d-44f9-a262-a31ba44f2aea", "url": "https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md"}], "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0.1.0,1.53.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Snowpark Python SDK", "source": "cna", "vendor": "Snowflake"}, "product": "snowpark_python_sdk", "vendor": "snowflake"}], "created": "2026-07-09T10:00:15.442566+00:00", "updated": "2026-08-01T16:15:07.344845+00:00", "vendors": ["snowflake", "snowflake$PRODUCT$snowpark_python_sdk"]}