CVE-2026-115324: Sql Injection Unescaped Quoted Interpolation Executed Statementcve-2026-115324-sql-injection-unescaped-quoted-interpolation-executed-statement
SQL is assembled by interpolating data ($X) directly inside single-quoted SQL string literals and executed via the Databricks statement-execution API without bind parameters. A crafted memory text, metadata value, or record ID containing a single quote terminates the SQL literal and injects arbitrary SQL (CWE-89): a tautology WHERE clause such as "' OR '1'='
