CVE-2026-15183

{"id": "CVE-2026-15183", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15183", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T12:21:22.026962Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 9.2, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "412d305a-227d-44f9-a262-a31ba44f2aea", "affectedData": [{"vendor": "Snowflake", "product": "Snowflake Spark Connector", "versions": [{"status": "affected", "version": "0.1.0", "lessThan": "3.2.1", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-07-14T09:16:40.443", "references": [{"url": "https://docs.snowflake.com/en/release-notes/clients-drivers/spark-connector-2026", "source": "412d305a-227d-44f9-a262-a31ba44f2aea"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "description": [{"lang": "en", "value": "CWE-89"}, {"lang": "en", "value": "CWE-441"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1 can allow attackers to exfiltrate OAuth client credentials, execute arbitrary SQL with the connector's Snowflake role, or redirect COPY operations to attacker-controlled storage. An attacker could exploit these vulnerabilities by supplying a crafted OAuth token request URL, placing malicious files in an ingestion pipeline, injecting SQL via staging options in a shared Spark environment , or issuing runtime SET commands in a shared Spark-SQL session to inject arbitrary SQL into the SnowflakeFallbackCatalog's option map, which executes under the cluster admin's JDBC credentials. Successful exploitation may result in credential theft, unauthorized access to Snowflake account data, or privilege escalation within connected infrastructure."}, {"lang": "es", "value": "M\u00faltiples vulnerabilidades de validaci\u00f3n de entrada en el Conector Snowflake Spark (spark-snowflake) versiones anteriores a la 3.2.1 pueden permitir a los atacantes exfiltrar credenciales de cliente OAuth, ejecutar SQL arbitrario con el rol de Snowflake del conector, o redirigir operaciones COPY a almacenamiento controlado por el atacante. Un atacante podr\u00eda explotar estas vulnerabilidades al proporcionar una URL de solicitud de token OAuth manipulada, colocar archivos maliciosos en una tuber\u00eda de ingesta, inyectar SQL a trav\u00e9s de opciones de staging en un entorno Spark compartido, o emitir comandos SET en tiempo de ejecuci\u00f3n en una sesi\u00f3n Spark-SQL compartida para inyectar SQL arbitrario en el mapa de opciones del SnowflakeFallbackCatalog, que se ejecuta bajo las credenciales JDBC del administrador del cl\u00faster. La explotaci\u00f3n exitosa puede resultar en robo de credenciales, acceso no autorizado a datos de la cuenta de Snowflake, o escalada de privilegios dentro de la infraestructura conectada."}], "lastModified": "2026-10-24T22:10:00.210", "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea"}