{"id":"CVE-2026-15062","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-15062","generatedAt":"2026-10-28T03:30:51.837Z","title":"SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope.","description":"SQL injection vulnerabilities in the Snowflake Snowpark Python SDK (snowpark-python) versions prior to 1.53.0 could allow authenticated low-privilege users to execute SQL beyond their authorization scope. An attacker could exploit these vulnerabilities by embedding SQL payloads in source database column names to escalate privileges via the DataFrameReader.dbapi() API by supplying a specially crafted location parameter to DataFrameWriter write methods to redirect a COPY INTO to an arbitrary source query, or by including a backslash-single-quote sequence in an export path to defeat the normalize_path() sanitizer and inject SQL via DataFrame.to_csv(). Successful exploitation may result in source database compromise, unauthorized cross-tenant data exfiltration, or unauthorized read of Snowflake account data.","published":"2026-07-08T15:16:26.000Z","lastModified":"2026-10-25T20:10:00.000Z","status":"Awaiting Analysis","sourceIdentifier":"412d305a-227d-44f9-a262-a31ba44f2aea","cvss":{"version":"3.1","score":9.6,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N"},"cwe":["CWE-89"],"affected":[],"epss":{"score":0.00386,"percentile":0.32386,"date":"2026-10-26","history":[]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.39%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[],"references":[{"url":"https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md","source":"412d305a-227d-44f9-a262-a31ba44f2aea"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-15062","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}