SQL Injection Risk in Snowflake Connector for Python and Universal Core

CVE-2026-123859

What is CVE-2026-123859?

A vulnerability exists in the Snowflake Connector for Python and Snowflake Connector for Python (Universal Core) that could allow SQL injection when identifier escaping is disabled. This occurs if an application accepts untrusted input for DataFrame column names, which are then directly included in generated SQL queries without proper escaping. An attacker could exploit this flaw to execute arbitrary SQL commands, potentially gaining unauthorized access to sensitive data or causing data manipulation. Users are advised to update to the latest versions to mitigate this risk.

References