External risk intelligence

Snowflake Spark Connector Input Validation Vulnerabilities Allow Credential Exfiltration and SQL Injection.

CVE advisorySeverity: CRITICAL (CVSS 9.2)

CVE-2026-15183

The Snowflake Spark Connector is used within internal data processing pipelines, Spark clusters, or analytics environments. These are typically isolated backend systems or internal infrastructure, not public-facing services. While network-reachable within a corporate environment, direct public internet exposure of the connector itself is uncommon.

SQL Injection

Halo Surface Signal: 2 out of 5 — less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns multiple input validation vulnerabilities within the Snowflake Spark Connector. These flaws could potentially allow unauthorized access to sensitive information, including OAuth client credentials, and enable the execution of arbitrary SQL commands. The core issue lies in how the connector handles specific input requests, which, if manipulated, could lead to credential theft, data breaches, or unauthorized system modifications within connected Snowflake environments.

Input flaws allow data theft and SQL injection.
Affects internal data pipelines and analytics.
Confirm relevance and identify any exposure.

Attack Path

How an attacker could exploit the issue

Attackers can exploit vulnerabilities in the Snowflake Spark Connector by interacting with shared Spark environments or by crafting specific requests. This could allow them to steal sensitive credentials, run unauthorized SQL commands, or redirect data operations.

No authentication required for entry.
Crafted inputs trigger the vulnerability.
Risk of credential theft and unauthorized access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could impact systems using the Snowflake Spark Connector by exposing OAuth client credentials, enabling arbitrary SQL execution within Snowflake, or redirecting data operations. These risks materialize when an attacker can manipulate specific connector inputs, such as crafted URLs, malicious files, or runtime commands in a shared Spark environment.

OAuth client credentials.
Manipulated connector inputs.
Unauthorized data access or escalation.

Operational Fix

Recommended remediation, mitigation, and detection steps

Identifying the correct teams to address this vulnerability involves understanding the Snowflake Spark Connector's role within your data architecture. Platform or data engineering teams managing Spark environments and data pipelines are likely primary stakeholders, alongside application owners who rely on the connector for data access. Initial steps should focus on inventorying all instances of the connector, determining their exposure to potential attackers, and identifying the business criticality of affected data or processes to prioritize remediation efforts.

Confirm Spark connector ownership and scope.
Verify exposure and data criticality.
Plan remediation with data teams.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Snowflake Spark Connector?

The Snowflake Spark Connector is a software library designed to bridge Apache Spark environments with Snowflake's data platform. Data engineers use it to facilitate high-speed data movement and complex analytics between these systems. It enables Spark to read from or write to Snowflake, essentially serving as a data pipeline component that handles credentials, connectivity, and command execution for large-scale processing jobs.

What does CVE-2026-15183 mean in plain English?

This CVE describes a group of input validation vulnerabilities. Essentially, the software fails to properly check the data it receives before processing it. This weakness allows an attacker to 'trick' the connector into performing unintended actions, such as leaking OAuth credentials, executing unauthorized SQL queries against a Snowflake database, or redirecting data flows to external storage locations.

How can this vulnerability be triggered?

The vulnerability is triggered when a user or process provides specifically crafted input to the connector. This could involve using a manipulated OAuth token request URL, placing malicious files within an ingestion pipeline, or injecting unauthorized SQL commands during a shared Spark-SQL session. Note that simply running a standard, well-defined Spark job in isolation typically does not trigger these issues; the risk arises when inputs are untrusted or manipulated.

Is my system at risk for CVE-2026-15183?

According to Halo Surface Signal, the Snowflake Spark Connector is typically utilized within internal data pipelines or analytics clusters rather than being exposed directly to the public internet. While it is likely present in your internal infrastructure, your immediate risk depends on whether your Spark environments are shared among multiple users or if you permit untrusted inputs within those pipelines, which could be leveraged to reach the connector.

What are the first steps to address this?

Start by identifying all instances of the Spark connector in your environment and confirm who manages those specific data pipelines. Once you have an inventory, coordinate with your data engineering or platform teams to prioritize these assets based on the sensitivity of the data they handle. The primary goal is to assess where untrusted input might reach the connector while you plan for a formal update to a secure, patched version of the software.

References

docs.snowflake.com/en/release-notes/clients-drivers/spark-connector-2026

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.