Is CVE-2026-15062 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-15062 being exploited in the wild.

How severe is CVE-2026-15062?

Critical severity, with a CVSS score of 9.6, published 8 July 2026.

Which products and versions are affected?

Snowflake Snowpark Python SDK >= 0.1.0, < 1.53.0.

Is there a fix for CVE-2026-15062?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-15062 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-15062?

Check whether you run Snowflake Snowpark Python SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15062: Snowflake Snowpark Python SDK SQL injection in multiple components

Q: Is there a fix for CVE-2026-15062?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-15062 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-15062?

Check whether you run Snowflake Snowpark Python SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-15062 · Severity: critical · CVSS 9.6 · Published 2026-07-08

The Snowflake Snowpark Python SDK, a library used by developers to build data applications, contains vulnerabilities that could allow users with low-level access to execute unauthorized database commands. An attacker could exploit this to bypass security restrictions, potentially leading to the theft of sensitive data across different customer accounts or full compromise of the source database. Organizations using this SDK should update to version 1.53.0 or later to protect their data and operations.

Vendors: Snowflake.

Quick answers

Is CVE-2026-15062 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-15062 being exploited in the wild.
How severe is CVE-2026-15062?: Critical severity, with a CVSS score of 9.6, published 8 July 2026.
Which products and versions are affected?: Snowflake Snowpark Python SDK >= 0.1.0, < 1.53.0.
Is there a fix for CVE-2026-15062?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-15062 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-15062?: Check whether you run Snowflake Snowpark Python SDK at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Multiple SQL injection vulnerabilities exist in the Snowflake Snowpark Python SDK (snowpark-python) prior to version 1.53.0. The flaws stem from improper neutralization of special elements in several components: the DataFrameReader.dbapi() API (via column names), DataFrameWriter write methods (via the location parameter), and DataFrame.to_csv() (via export paths that bypass the normalize_path sanitizer). An authenticated attacker with low privileges can exploit these to execute arbitrary SQL, potentially leading to cross-tenant data exfiltration or unauthorized access to Snowflake account data. The issue is addressed in version 1.53.0.

Affected products

Snowflake Snowpark Python SDK >= 0.1.0, < 1.53.0

Timeline

2026-07-08: disclosed
2026-07-08: advisory

References

https://github.com/snowflakedb/snowpark-python/blob/main/CHANGELOG.md

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.