CVE-2026-15062

{
  "id": "CVE-2026-15062",
  "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea",
  "published": "2026-07-08T15:16:26.320",
  "lastModified": "2026-10-25T20:10:00.147",
  "vulnStatus": "Awaiting Analysis",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data."
    },
    {
      "lang": "es",
      "value": "Las vulnerabilidades de inyección SQL en el SDK de Python Snowflake Snowpark (snowpark-python) versiones anteriores a la 1.53.0 podrían permitir a usuarios autenticados con bajos privilegios ejecutar SQL más allá de su ámbito de autorización. Un atacante podría explotar estas vulnerabilidades incrustando cargas útiles SQL en nombres de columnas de bases de datos de origen para escalar privilegios a través de la API DataFrameReader.dbapi() suministrando un parámetro de ubicación especialmente diseñado a los métodos de escritura de DataFrameWriter para redirigir un COPY INTO a una consulta de origen arbitraria, o incluyendo una secuencia de barra invertida-comilla simple en una ruta de exportación para eludir el saneador normalize_path() e inyectar SQL a través de DataFrame.to_csv(). La explotación exitosa podría resultar en el compromiso de la base de datos de origen, la exfiltración de datos no autorizada entre inquilinos o la lectura no autorizada de datos de la cuenta de Snowflake."
    }
  ],
  "affected": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "affectedData": [
        {
          "vendor": "Snowflake",
          "product": "Snowpark Python SDK",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "0.1.0",
              "lessThan": "1.53.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
          "baseScore": 9.6,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "CHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 3.1,
        "impactScore": 5.8
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-07-08T15:14:28.232574Z",
          "id": "CVE-2026-15062",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md",
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea"
    }
  ]
}