# CVE-2026-123859

SQL injection in Snowflake Python connectors via crafted DataFrame column names

- Page: https://www.vulneraibility.com/cve/CVE-2026-123859
- CVSS: 8.1
- Known exploited: not in CISA KEV as of our last sync
- CISA SSVC: exploitation none, automatable no, technical impact total (assessed 2026-11-06)
- Weakness: CWE-89
- Published: 2026-11-06

## Affected versions

- Snowflake Snowflake Connector for Python: affected >= 2.3.4 and < 4.8.1
- Snowflake Snowflake Connector for Python (Universal Core): affected >= 5.0.0b1 and < 5.2.0

A version outside these ranges is not a statement that it is unaffected.

## Impact

SQL injection allows attacker-controlled column names to read, modify, or delete data accessible to the application's Snowflake role.

## Action

Immediate action required

## Recommendation

Upgrade to 4.8.1 (Python) and 5.2.0 (Universal Core); disallow or sanitize untrusted column names.

## References

- [other] https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-481-oct-26-2026
- [other] https://docs.snowflake.com/en/release-notes/clients-drivers/python-connector-2026#version-520-nov-4-2026

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.