CVE-2026-15183

Executive Summary

CVE-2026-15183 is a critical vulnerability in the Snowflake Spark Connector (spark-snowflake) affecting versions prior to 3.2.1. The vulnerability stems from multiple input validation failures that allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. Attack vectors include supplying a crafted OAuth token request URL, placing malicious files in an ingestion pipeline, injecting SQL via staging options in a shared Spark environment, or issuing runtime SET commands in a shared Spark-SQL session to inject arbitrary SQL into the SnowflakeFallbackCatalog's option map. Successful exploitation can lead to credential theft, unauthorized data access, and privilege escalation within connected infrastructure.

Supply Chain & Package Security

This vulnerability affects the Snowflake Spark Connector, which is distributed as a Java library (JAR) via Maven Central and other package repositories. Organizations using this connector in their data pipelines should verify their dependency version and update to 3.2.1 or later. The connector is commonly used in Apache Spark environments for data ingestion and transformation, making it a high-value target for supply chain attacks.

CVSS Breakdown & Threat Level

CVSS Score: 0.0 (Not yet assigned) Threat Level: Critical (based on impact analysis)

While no official CVSS vector is available, the vulnerability's potential for credential theft, arbitrary SQL execution, and privilege escalation suggests a high severity rating. The attack complexity is low, requiring only network access to a shared Spark environment or the ability to supply crafted inputs.

Deep Dive & Mechanics

The vulnerability exists in multiple components of the Snowflake Spark Connector:

1. OAuth Token Request URL Injection: The connector does not properly validate the OAuth token request URL, allowing an attacker to supply a malicious URL that redirects OAuth client credentials to an attacker-controlled server.

2. Ingestion Pipeline File Injection: When processing files from an ingestion pipeline, the connector fails to validate file paths or contents, allowing an attacker to place malicious files that are executed during the ingestion process.

3. SQL Injection via Staging Options: In a shared Spark environment, an attacker can inject SQL commands through staging options, which are then executed with the connector's Snowflake role.

4. Runtime SET Command Injection: In a shared Spark-SQL session, an attacker can issue runtime SET commands that inject arbitrary SQL into the SnowflakeFallbackCatalog's option map. This SQL executes under the cluster admin's JDBC credentials, leading to privilege escalation.

The root cause is insufficient input validation across multiple entry points, allowing attackers to manipulate the connector's behavior and gain unauthorized access to Snowflake resources.

Vulnerable vs. Patched Code

Vulnerable Code (pre-3.2.1):

// Example of vulnerable OAuth URL handling
public String getOAuthToken(String url) {
    // No validation of the URL
    HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
    // ... sends credentials to the URL
}

Patched Code (3.2.1+):

// Example of patched OAuth URL handling
public String getOAuthToken(String url) {
    // Validate the URL against a whitelist
    if (!isAllowedUrl(url)) {
        throw new SecurityException("Invalid OAuth token request URL");
    }
    HttpURLConnection connection = (HttpURLConnection) new URL(url).openConnection();
    // ... sends credentials to the URL
}

The patch adds input validation and whitelisting for OAuth URLs, file paths, and SQL commands. It also sanitizes staging options and runtime SET commands to prevent injection attacks.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a shared Spark environment running the vulnerable connector
• Ability to supply crafted inputs (e.g., OAuth URL, staging options, SET commands)

Exploitation Steps:

1. OAuth Credential Theft:

   • Craft a malicious OAuth token request URL pointing to an attacker-controlled server
   • Supply this URL to the connector via the OAuth configuration
   • Capture the OAuth client credentials from the incoming request

2. SQL Injection via Staging Options:

   • In a shared Spark environment, set malicious staging options that contain SQL commands
   • The connector executes these commands with its Snowflake role, allowing data exfiltration

3. Runtime SET Command Injection:

   • In a shared Spark-SQL session, issue a SET command that injects SQL into the SnowflakeFallbackCatalog's option map
   • The injected SQL executes under the cluster admin's JDBC credentials, granting elevated privileges

Example Exploit Code:

# Example of SET command injection
spark.sql("SET spark.sql.extensions=com.snowflake.spark.snowflake.SnowflakeFallbackCatalog")
spark.sql("SET spark.sql.catalog.snowflake.optionMap={\"query\":\"SELECT * FROM sensitive_data\"}")

Blue Team

Detection Steps:

1. Monitor for unusual OAuth token request URLs in logs
2. Alert on unexpected staging options or SET commands in Spark-SQL sessions
3. Review Snowflake audit logs for unauthorized SQL execution
4. Implement network segmentation to limit access to shared Spark environments

Hunting Queries:

• Search for logs containing "OAuth token request" with suspicious URLs
• Look for SET commands that modify the SnowflakeFallbackCatalog option map
• Identify ingestion pipelines with unexpected file sources

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual OAuth token request URLs (e.g., attacker-controlled domains)
  • Outbound connections to unknown IP addresses from Spark nodes
  • Anomalous Snowflake API calls with elevated privileges

• File IOCs:

  • Unexpected files in ingestion pipeline directories
  • Modified configuration files containing malicious staging options

• Log IOCs:

  • Log entries showing SET commands with suspicious option map values
  • Audit logs indicating unauthorized SQL execution under admin credentials

Detection Engineering

YARA Rule

rule CVE_2026_15183_Snowflake_Spark_Connector {
    meta:
        description = "Detects exploitation attempts of CVE-2026-15183 in Snowflake Spark Connector"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-15183"
    strings:
        $s1 = "OAuth token request" ascii wide nocase
        $s2 = "stagingOptions" ascii wide nocase
        $s3 = "SnowflakeFallbackCatalog" ascii wide nocase
        $s4 = "optionMap" ascii wide nocase
        $s5 = "SET spark.sql.catalog.snowflake" ascii wide nocase
    condition:
        any of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-15183 Snowflake Spark Connector Exploitation
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects exploitation attempts of CVE-2026-15183 in Snowflake Spark Connector
author: Valters IT
date: 2026-01-01
logsource:
    category: application
    product: spark
detection:
    selection:
        EventID: 100
        Message|contains:
            - 'OAuth token request'
            - 'stagingOptions'
            - 'SnowflakeFallbackCatalog'
            - 'optionMap'
            - 'SET spark.sql.catalog.snowflake'
    condition: selection
falsepositives:
    - Legitimate configuration changes
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-15183 Snowflake Spark Connector OAuth Exfiltration"; flow:to_server,established; content:"OAuth token request"; nocase; content:"http://"; distance:0; within:100; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Upgrade Snowflake Spark Connector to version 3.2.1 or later
   • Review and restrict access to shared Spark environments
   • Implement network segmentation for Spark nodes

2. Configuration Hardening:

   • Whitelist allowed OAuth token request URLs
   • Validate and sanitize all staging options
   • Restrict runtime SET commands to authorized users only

3. Monitoring and Logging:

   • Enable detailed logging for OAuth token requests, staging options, and SET commands
   • Implement alerts for suspicious activity
   • Regularly review Snowflake audit logs

4. Long-term Measures:

   • Conduct security reviews of all Spark connector configurations
   • Implement input validation libraries for all external inputs
   • Train development teams on secure coding practices

Valters IT
DevSecOps & Cyber Threat Intelligence Expert
This report is generated for educational and defensive purposes only.