SQL Injection Vulnerabilities in Snowflake SQLAlchemy by Snowflake
CVE-2026-15736

8.3HIGH

Key Information:

Vendor

Snowflake

Status
Snowflake Sqlalchemy
Vendor
CVE Published:
14 July 2026

What is CVE-2026-15736?

Snowflake SQLAlchemy prior to version 1.11.0 has several vulnerabilities, notably improper handling of user-supplied column identifiers during merge operations, which poses a risk of SQL injection. Attackers could exploit this through dynamic upsert endpoints, potentially gaining unauthorized access to data or altering values within the same MERGE statement. Furthermore, flaws in the rendering of bound parameters in specific table creation queries can lead to similar SQL injection risks. Additionally, due to incorrect handling of connection parameters, attackers may read arbitrary local files and exfiltrate their contents. Users are encouraged to upgrade to version 1.11.0 to mitigate these risks.

Affected Version(s)

Snowflake SQLAlchemy 1.1.6 < 1.11.0

References

https://github.com/snowflakedb/snowflake-sqlalchemy/releases

CVSS V3.1

Score:
8.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.