Spark-Snowflake Connector OAuth Credential Exposure

Executive Summary

CVE-2026-15183 describes multiple input validation vulnerabilities in the Snowflake Spark Connector (spark-snowflake) versions prior to 3.2.1. These vulnerabilities allow attackers to perform several malicious actions.

• Exfiltrate OAuth client credentials by supplying a crafted OAuth token request URL.
• Execute arbitrary SQL with the connector's Snowflake role by injecting SQL via staging options in a shared Spark environment or issuing runtime SET commands in a shared Spark-SQL session.
• Redirect COPY operations to attacker-controlled storage by placing malicious files in an ingestion pipeline.

Successful exploitation could lead to credential theft, unauthorized access to Snowflake account data, or privilege escalation within connected infrastructure.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability involves checking for the presence of vulnerable versions of the Snowflake Spark Connector (versions prior to 3.2.1) and monitoring for suspicious activities related to OAuth token requests, SQL injection attempts, or unauthorized COPY operations.

• Check the installed version of the Snowflake Spark Connector in your environment. If it is prior to 3.2.1, the system is vulnerable.
• Review logs for unusual OAuth token request URLs or unexpected redirects to external storage locations. The connector's logs may show masked sensitive DataSource options, but anomalous patterns should be investigated.
• Monitor Spark-SQL sessions for runtime SET commands that could inject arbitrary SQL into the SnowflakeFallbackCatalog's option map. Look for unexpected or unauthorized SQL queries executed under the cluster admin's JDBC credentials.
• Inspect ingestion pipelines for malicious files or unexpected COPY operations targeting attacker-controlled storage. Verify the integrity of staging options in shared Spark environments.

Commands or tools to assist detection:

• To check the Snowflake Spark Connector version, you can use Spark shell or submit a Spark job to print the connector version. Example command in Spark shell: spark.conf.get("spark.snowflake.connector.version")
• Review Spark logs for entries related to the Snowflake connector, particularly those involving OAuth token requests, SQL queries, or COPY operations. Use grep or similar tools to filter logs: grep -i "snowflake" /path/to/spark/logs/*
• For network-level detection, monitor for unusual outbound connections to external storage or OAuth endpoints that deviate from expected patterns.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts if exploited, including:

• Credential theft: Attackers may steal OAuth client credentials, allowing unauthorized access to your Snowflake environment.
• Unauthorized data access: Attackers could execute arbitrary SQL queries, accessing or modifying sensitive data stored in your Snowflake account.
• Privilege escalation: Attackers may escalate privileges within your connected infrastructure, potentially gaining control over additional systems or data.
• Data exfiltration: Attackers could redirect COPY operations to their own storage, leading to data leaks or loss of sensitive information.

These impacts could result in financial loss, reputational damage, or regulatory penalties depending on the nature of the data involved.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can significantly impact compliance with common standards and regulations in the following ways:

• GDPR (General Data Protection Regulation): Unauthorized access to or exfiltration of personal data could violate GDPR requirements, leading to potential fines and legal consequences. GDPR mandates strict controls over personal data, and a breach could result in non-compliance.
• HIPAA (Health Insurance Portability and Accountability Act): If the affected Snowflake environment contains protected health information (PHI), unauthorized access or data exfiltration could violate HIPAA's privacy and security rules, resulting in penalties and legal action.
• Other regulations: Depending on the industry, this vulnerability could also impact compliance with standards like PCI DSS (for payment data), SOX (for financial reporting), or industry-specific regulations that require data protection and access controls.

Organizations must ensure they apply the necessary patches or mitigations to avoid non-compliance and potential regulatory consequences.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, follow these immediate steps:

• Upgrade the Snowflake Spark Connector to version 3.2.1 or later. This version includes fixes for the input validation vulnerabilities, such as restricting the fallback catalog to merge only immutable Spark configurations, masking sensitive DataSource options in logs, and validating OAuth token request URLs.
• Ensure that the Snowflake JDBC driver version 4.0.2 or later is used, as required by the updated connector versions.
• Review and restrict permissions for the Snowflake role used by the connector. Limit the role's access to only the necessary data and operations to reduce the impact of potential exploitation.
• Monitor and audit Spark-SQL sessions for unauthorized runtime SET commands or suspicious SQL queries. Implement logging and alerting for unusual activities.
• Validate and sanitize all inputs to the connector, particularly OAuth token request URLs, staging options, and COPY operation targets. Ensure that only trusted and verified sources are used.
• Isolate shared Spark environments to prevent unauthorized users from injecting malicious SQL or staging options. Use dedicated environments for sensitive operations where possible.
• Rotate OAuth client credentials and JDBC credentials if there is any suspicion of compromise. Ensure that credentials are stored securely and not exposed in logs or configuration files.

Useful 0 Not Useful 0