CVE-2026-123859 Details
Description
When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually.
A SQL injection vulnerability has been identified in the Snowflake Connector for Python, specifically in the data-loading function write_pandas(). This issue arises when identifier escaping is disabled through a non-default configuration. In both the standard Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core), the write_pandas() function failed to properly escape DataFrame column names before incorporating them into the generated SQL. This oversight could enable an attacker to inject malicious SQL, potentially leading to unauthorized data access or manipulation, depending on the application's Snowflake role permissions. Exploitation of this vulnerability requires the application to pass attacker-controlled column names into the write_pandas() function.
Users should upgrade to Snowflake Connector for Python version 4.8.1 or Snowflake Connector for Python (Universal Core) version 5.2.0. Instructions for upgrading are available in the Snowflake documentation.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Nov 6, 2026CISA-ADP
Assessed Nov 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-481-oct-26-2026 | SNOWFLAKE | Release NotesVendor |
| https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-520-nov-4-2026 | SNOWFLAKE |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | SNOWFLAKE |
Affected Products
| Product | Versions |
|---|---|
| Snowflake Connector for Python | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 6, 2026 | New CVE Received | SNOWFLAKE |
| Nov 6, 2026 | CVE Modified | CISA-ADP |