Vulnerability class

SQL injection

Values interpolated into a SQL query instead of being bound as parameters.

1 write-up, 1 vulnerability

CVE-2026-41490

8.3 · High

17 Apr 2026 8 min

SQL injection in Dagster database I/O managers through dynamic partition keys

Dagster’s DuckDB, Snowflake, BigQuery and DeltaLake I/O managers copied dynamic partition keys into SQL, so adding a partition was enough to inject queries.

SQL injection
Variant analysis
Data platforms

Vulnerabilities

Identifier	Product	Vulnerability	CVSS	Published
CVE-2026-41490	Dagster	SQL injection through dynamic partition keys in database I/O managers	8.3 High	17 Apr 2026

All vulnerabilities