Snowflake Connector for Spark 3.2.1 Patch: Fixes SQL Injection in CREATE STAGE and Log Redaction for Sensitive Data

Vulnerability Overview Vulnerability Name: The specific vulnerability name is not explicitly stated, but it involves multiple fixes in Snowflake Connector for Spark. Affected Version: Snowflake Connector for Spark 3.2.1 (released on July 8, 2026). Impact Scope Behavioral Changes: - The merging of the fallback catalog is restricted, allowing only immutable Spark configurations. Runtime and session settings can no longer override trusted catalog connection options. New Features: - The connector registers sensitive DataSource options for Spark log redaction, ensuring they are masked in logs, outputs, and the UI. User-facing Bug Fixes: - Fixed identifier references to escape embedded quotation characters. - Fixed the CREATE STAGE construct to escape SQL characters within interpolated strings. Remediation Behavioral Changes: - By restricting the merging of the fallback catalog, it ensures that only immutable Spark configurations are used, preventing runtime and session settings from overriding trusted catalog connection options. New Features: - Registered sensitive DataSource options for Spark log redaction, ensuring that sensitive information is masked in logs, outputs, and the UI. User-facing Bug Fixes: - Fixed identifier references to ensure embedded quotation characters are properly escaped. - Fixed the CREATE STAGE construct to ensure SQL characters are properly escaped within interpolated strings. POC Code or Exploit Code No specific POC code or exploit code is provided in this document. Summary The Snowflake Connector for Spark version 3.2.1 (released on July 8, 2026) includes multiple fixes primarily involving behavioral changes, new features, and user-facing bug fixes. These updates aim to enhance system security and stability, preventing sensitive information leakage and configuration conflicts.

Goal Reached Thanks to every supporter — we hit 100%!

Snowflake Connector for Spark 3.2.1 Patch: Fixes SQL Injection in CREATE STAGE and Log Redaction for Sensitive Data