Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-15736— Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy

Quick assessment

Affected
Snowflake Snowflake SQLAlchemy
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Snowflake SQLAlchemy是美国Snowflake公司开源的一款 SQL 工具包和对象关系映射器（ORM），它为企业级应用提供了高效、高性能的数据库访问，并将这些模式融入简洁且 Pythonic 的领域语言中。 Snowflake SQLAlchemy 1.11.0之前版本存在安全漏洞，该漏洞源于合并操作对用户提供的列标识符处理不当、构建表创建查询时参数边界文字渲染不当以及连接配置参数转发不当，可能导致SQL注入、任意数据渗出和读取任意本地文件。

CVSS 8.3 · High EPSS 0.38% · P30

Affected Version Matrix 1

VendorProduct Version RangeStatus
Snowflake Snowflake SQLAlchemy 1.1.6< 1.11.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-15736

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Multiple SQL/DDL Injection and Arbitrary File Read Vulnerabilities in snowflake-sqlalchemy
Source: CVE Program / CVE List V5
Vulnerability Description
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
SQL命令中使用的特殊元素转义处理不恰当(SQL注入)
Source: CVE Program / CVE List V5
Vulnerability Title
Snowflake SQLAlchemy 输入验证错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Snowflake SQLAlchemy是美国Snowflake公司开源的一款 SQL 工具包和对象关系映射器（ORM），它为企业级应用提供了高效、高性能的数据库访问，并将这些模式融入简洁且 Pythonic 的领域语言中。 Snowflake SQLAlchemy 1.11.0之前版本存在安全漏洞，该漏洞源于合并操作对用户提供的列标识符处理不当、构建表创建查询时参数边界文字渲染不当以及连接配置参数转发不当，可能导致SQL注入、任意数据渗出和读取任意本地文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Snowflake Snowflake SQLAlchemy 1.1.6 ~ 1.11.0 -

II. Public POCs for CVE-2026-15736

# POC Description Source Link Shenlong Link
AI-Generated POC Verified env Premium
Reproduced successfully in a real sandbox · Below is the actual recording of building the environment and exploiting the vulnerability.
Success marker: VULNERABLE: secret token not transmitted to attacker endpoint
Reproduction recording is a Pro+ exclusive
Watch the full sandbox build + live exploit recording for this CVE. Limited-time ¥499/mo.
Upgrade to Pro+
Qwen3.6-35B-A3B · 14388 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month

III. Intelligence Information for CVE-2026-15736

请登录查看更多情报信息。

Vendor Pages for CVE-2026-15736 (1)

IV. Related Vulnerabilities

Same vendor: Snowflake
Same weakness: CWE-89

V. Comments for CVE-2026-15736

No comments yet

Leave a comment