CVE-2026-15736

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-15736", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "state": "PUBLISHED", "assignerShortName": "SNOWFLAKE", "dateReserved": "2026-07-14T14:01:42.714Z", "datePublished": "2026-07-14T14:11:31.279Z", "dateUpdated": "2026-07-14T15:14:26.264Z"}, "containers": {"cna": {"title": "Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy", "descriptions": [{"lang": "en", "value": "Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade."}], "affected": [{"vendor": "Snowflake", "product": "Snowflake SQLAlchemy", "versions": [{"version": "1.1.6", "lessThan": "1.11.0", "versionType": "semver", "status": "affected"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}, {"lang": "en", "cweId": "CWE-73", "description": "External Control of File Name or Path", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L"}}], "references": [{"url": "https://github.com/snowflakedb/snowflake-sqlalchemy/releases", "name": "Snowflake SQLAlchemy Release Notes"}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-07-14T14:11:31.279Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T15:14:20.847658Z", "id": "CVE-2026-15736", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:14:26.264Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-15736", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-07-14T15:14:20.847658Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T15:14:23.038Z"}}], "cna": {"title": "Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Snowflake", "product": "Snowflake SQLAlchemy", "versions": [{"status": "affected", "version": "1.1.6", "lessThan": "1.11.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://github.com/snowflakedb/snowflake-sqlalchemy/releases", "name": "Snowflake SQLAlchemy Release Notes"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}, {"lang": "en", "type": "CWE", "cweId": "CWE-73", "description": "External Control of File Name or Path"}]}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-07-14T14:11:31.279Z"}}}, "cveMetadata": {"cveId": "CVE-2026-15736", "state": "PUBLISHED", "dateUpdated": "2026-07-14T15:14:26.264Z", "dateReserved": "2026-07-14T14:01:42.714Z", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "datePublished": "2026-07-14T14:11:31.279Z", "assignerShortName": "SNOWFLAKE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Snowflake SQLAlchemy", "vendor": "Snowflake", "versions": [{"lessThan": "1.11.0", "status": "affected", "version": "1.1.6", "versionType": "semver"}]}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade."}, {"lang": "es", "value": "Las versiones de Snowflake SQLAlchemy anteriores a la 1.11.0 contienen varias vulnerabilidades de seguridad, incluyendo: El manejo inadecuado de identificadores de columna proporcionados por el usuario en operaciones de fusi\u00f3n podr\u00eda permitir inyecci\u00f3n SQL a trav\u00e9s de claves de entrada controladas por el atacante. Un atacante podr\u00eda explotar esto a trav\u00e9s de nombres de campos de solicitud en un endpoint de upsert din\u00e1mico, potencialmente habilitando el acceso de lectura a datos visibles para el rol de base de datos de la aplicaci\u00f3n o la modificaci\u00f3n de valores dentro de la misma sentencia MERGE. El renderizado literal inadecuado de par\u00e1metros vinculados al construir ciertas consultas de creaci\u00f3n de tablas espec\u00edficas de Snowflake podr\u00eda permitir inyecci\u00f3n SQL. Un atacante podr\u00eda explotar esto suministrando una cadena manipulada a cualquier endpoint de aplicaci\u00f3n que pasa datos controlados por el usuario a trav\u00e9s de la API de construcci\u00f3n de consultas afectada, potencialmente causando la exfiltraci\u00f3n arbitraria de datos dentro del alcance del rol de conexi\u00f3n. El reenv\u00edo inadecuado de par\u00e1metros de configuraci\u00f3n de conexi\u00f3n podr\u00eda permitir a un atacante hacer que la biblioteca lea archivos locales arbitrarios y transmita su contenido a un endpoint controlado por el atacante. Un atacante podr\u00eda explotar esto en entornos de despliegue que aceptan par\u00e1metros de conexi\u00f3n controlados por el usuario, potencialmente exponiendo archivos sensibles accesibles al proceso de la aplicaci\u00f3n. La soluci\u00f3n est\u00e1 disponible en la versi\u00f3n 1.11.0 de Snowflake SQLAlchemy. Los usuarios deben actualizar manualmente."}], "id": "CVE-2026-15736", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-15736", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T15:14:20.847658Z", "version": "2.0.3"}}]}, "published": "2026-07-14T15:17:01.073", "references": [{"source": "412d305a-227d-44f9-a262-a31ba44f2aea", "url": "https://github.com/snowflakedb/snowflake-sqlalchemy/releases"}], "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-89"}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.1.6,1.11.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Snowflake SQLAlchemy", "source": "cna", "vendor": "Snowflake"}, "product": "snowflake_sqlalchemy", "vendor": "snowflake"}], "created": "2026-07-16T07:30:05.076488+00:00", "updated": "2026-07-31T10:30:17.985488+00:00", "vendors": ["snowflake", "snowflake$PRODUCT$snowflake_sqlalchemy"]}