Snowflake Connector for Spark 3.2.1 Fixes Catalog Override, Injection Flaws

Snowflake shipped version 3.2.1 of its Connector for Spark on July 8, 2026, closing out a security-focused patch cycle that addresses configuration-override risks, credential leakage in logs, and SQL injection-adjacent flaws in identifier handling.

The release caps off a busy first half of 2026 for the connector, which also saw major platform expansion, including Spark 4.0/4.1 support in version 3.2.0 and OAuth client credentials authentication in 3.1.9.

For organizations running Snowflake-backed Spark pipelines in production, this release cycle matters less for new capabilities and more for the quiet but consequential hardening of trust boundaries between Spark session configs and Snowflake’s connection layer.

Snowflake Connector for Spark

The July 8 patch fixes five distinct issues, most centered on trust boundary enforcement:

Restricted the fallback catalog to merge only immutable Spark configuration, preventing runtime or session settings from overriding trusted catalog connection options
Registered sensitive DataSource options with Spark’s log redaction framework, masking credentials in logs, plan output, and the Spark UI
Fixed identifier quoting to properly escape embedded quote characters
Fixed CREATE STAGE statement construction to escape SQL metacharacters in interpolated values
Added scheme and host validation for OAuth token request URLs

The catalog-override fix is the most significant from a security architecture standpoint. Previously, a malicious or misconfigured session could potentially override trusted connection settings at runtime a subtle privilege escalation path that’s easy to overlook in multi-tenant Spark environments.

Released June 23, this update focused on platform compatibility rather than fixes:

Added support for Apache Spark 4.0 and 4.1 (Scala 2.13, JDK 17)
Introduced a Scala 2.13 cross-build for Spark 3.5
Extended VariantType support for reading/writing Snowflake VARIANT columns under Spark 4.x, including the Parquet write path

The behavior change here demands attention: the connector now requires Snowflake JDBC driver 4.0.2 or later at runtime. Teams pinning specific JDBC versions in their build pipelines need to bump this dependency or risk runtime failures.

Snowflake also relocated the AWS SDK and Azure Storage SDK inside the connector JAR itself, eliminating transitive dependency conflicts that have historically plagued Spark environments juggling multiple cloud SDK versions.

May’s release (May 13) added OAuth client credentials authentication, a meaningful addition for enterprises standardizing on OAuth-based service-to-service auth rather than key-pair or username/password credentials.

Two bug fixes stand out for reliability-conscious teams:

Prevented silent data loss when speculative tasks are killed mid-upload during stage writes
Added missing TimestampNTZType support in the Parquet write path

The speculative task fix is particularly important. Spark’s speculative execution kills duplicate tasks when one finishes first, and if that coincided with an in-progress stage upload, data could vanish without any error signal a nightmare scenario for data engineering teams trusting pipeline completion status.

The March 13 release contained no new features, focusing solely on fixing an UnsupportedOperationException: Unexpected type: NullType error triggered when writing DataFrames with all-null StructType columns via the Parquet write path a narrow but real edge case for schema-evolving data pipelines.

Full technical documentation is available at Snowflake’s Spark Connector docs.