CVE-2026-123859

When identifier escaping is disabled through a non-default configuration, the write_pandas() data-loading functionality in the Snowflake Connector for Python and the Snowflake Connector for Python (Universal Core) did not escape DataFrame column names before including them in generated SQL, which could allow SQL injection. In both products, a crafted column name could have been used to chain additional SQL statements onto the generated statement, potentially allowing an attacker to read, modify, or delete other data accessible to the application's Snowflake role. Exploitation required an application to pass attacker controlled column names into this functionality. The fix is available in Snowflake Connector for Python version 4.8.1 and Snowflake Connector for Python (Universal Core) version 5.2.0. Users must upgrade manually.

• CWE-89

• https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-481-oct-26-2026
• https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-520-nov-4-2026

Published

Nov 6, 2026

Last Modified

Nov 6, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-123853In JetBrains IntelliJ IDEA before 2026.3, 2026.2.2 code exe…7.8
• CVE-2026-123854In JetBrains PyCharm before 2026.3 code execution was possib…5.5
• CVE-2026-123855In JetBrains Toolbox App before 3.6.1 command injection was …7.5
• CVE-2026-123856In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure w…6.5
• CVE-2026-123857In JetBrains PhpStorm before 2026.3 xXE was possible in untr…4.3
• CVE-2026-123858In JetBrains PhpStorm before 2026.3 project files could be a…4.4
• CVE-2026-12386Improper null termination vulnerability in TUBITAK BILGEM So…3.9
• CVE-2026-12387Use After Free vulnerability in Arm Ltd Bifrost GPU Kernel D…5.1
• CVE-2026-123876A flaw was found in the default seccomp profile used by Podm…4.4
• CVE-2026-12388A flaw was found in the Identity Provider (IdP) mapper compo…6.5
• CVE-2026-1239The Ninja Forms – The Contact Form Builder That Grows With Y…7.5
• CVE-2026-12390In AzeoTech DAQFactory versions 21.1 and prior, a Type Confu…7.8