Is CVE-2026-123859 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123859 being exploited in the wild.

How severe is CVE-2026-123859?

High severity, with a CVSS score of 8.1, published 6 November 2026.

Which products and versions are affected?

Snowflake Connector for Python before 4.8.1; Snowflake Connector for Python (Universal Core) before 5.2.0.

How is CVE-2026-123859 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123859?

Check whether you run Snowflake Connector for Python or Snowflake Connector for Python (Universal Core) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123859: Snowflake Connector for Python SQL injection in write_pandas()

CVE-2026-123859 · Severity: high · CVSS 8.1 · Published 2026-11-06

The Snowflake Connector for Python's write_pandas() function fails to escape DataFrame column names when identifier escaping is disabled, allowing SQL injection attacks. An attacker who controls column names can execute arbitrary SQL statements to read, modify, or delete data accessible to the application's Snowflake role, leading to potential data breach or corruption.

Technologies: Snowflake Connector for Python. Vendors: Snowflake.

Quick answers

Is CVE-2026-123859 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123859 being exploited in the wild.
How severe is CVE-2026-123859?: High severity, with a CVSS score of 8.1, published 6 November 2026.
Which products and versions are affected?: Snowflake Connector for Python before 4.8.1; Snowflake Connector for Python (Universal Core) before 5.2.0.
Is there a fix for CVE-2026-123859?: Yes: fixed in Snowflake Connector for Python 4.8.1 and later; Snowflake Connector for Python (Universal Core) 5.2.0 and later. Until then: Ensure identifier escaping is enabled through the default configuration (quote_identifiers=True) or restrict applications to only pass trusted, internally-generated column names to write_pandas().</anigation> <parameter name="timeline">[ { "kind": "advisory", "at": "2026-11-06" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123859 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123859?: Check whether you run Snowflake Connector for Python or Snowflake Connector for Python (Universal Core) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Snowflake Connector for Python 4.8.1 and later; Snowflake Connector for Python (Universal Core) 5.2.0 and later

Ensure identifier escaping is enabled through the default configuration (quote_identifiers=True) or restrict applications to only pass trusted, internally-generated column names to write_pandas().</anigation> <parameter name="timeline">[ { "kind": "advisory", "at": "2026-11-06" } ]

Technical details

When the non-default configuration disables identifier escaping, the write_pandas() data-loading function does not sanitize DataFrame column names before embedding them in generated SQL statements, enabling SQL injection. An attacker must supply crafted column names to the vulnerable function; successful exploitation allows chaining additional SQL statements to access or modify data within the Snowflake role's permissions. The vulnerability is fixed in version 4.8.1 and above.

Affected products

Snowflake Connector for Python before 4.8.1
Snowflake Connector for Python (Universal Core) before 5.2.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.