CVE-2026-15736
HighCVSS 8.3Exploitation Probability (EPSS)
Low risk31th percentile - higher than 31% of all known CVEs
Summary
Snowflake SQLAlchemy versions prior to 1.11.0 contain multiple vulnerabilities: improper handling of column identifiers in MERGE operations allows SQL injection via attacker-controlled keys; improper literal rendering of bound parameters in CREATE TABLE queries allows SQL injection; improper forwarding of connection configuration parameters allows reading arbitrary local files and transmitting their contents to an attacker.
Risk Assessment
An attacker may gain unauthorized read access to data visible to the application's database role, modify values within a MERGE statement, exfiltrate arbitrary data, or read sensitive local files accessible to the application process.
Recommendation
Upgrade Snowflake SQLAlchemy to version 1.11.0 or later immediately.
Related vulnerabilities
- CVE-2026-89126Critical
SAP Web Dispatcher does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-89119Critical
SAP Web Dispatcher and SAP NetWeaver Application Server ABAP (Internet Communication Manager) do not perform sufficient request validation in certain administrative functionality. An unauthenticated attacker could trick a logged-on administrator into visiting a malicious link, causing unintended actions in the administrator's session and potentially leading to full compromise of the underlying operating system.
- CVE-2026-89103Critical
SAP Gateway activates the default Access Control List with high privileges, allowing categorization of an external attacker as an internal application server. An unauthenticated attacker with network access to SAP Gateway could exploit this weakness to perform unauthorized actions within the application environment.
- CVE-2026-76965Critical
SAP NetWeaver Application Server ABAP and ABAP Platform do not perform necessary authorization checks for certain internal functionality. An attacker with low privileges could invoke the affected functionality to execute arbitrary operating system commands on the underlying host.
- CVE-2026-76964Critical
SAP NetWeaver Application Server ABAP does not sufficiently validate certain network input processed by an internal component. An unauthenticated attacker could send specially crafted network traffic to trigger memory corruption, potentially leading to arbitrary code execution and full system compromise.
- CVE-2026-125086Critical
D-Link M60 1.12.B01 contains hard-coded credentials in the /etc/emDaemon/mosquitto.conf file of the emDaemon MQTT Broker component. The vulnerability can be exploited remotely, and a public exploit may already be in use.
- CVE-2026-124600Critical
GV-Face transmits sensitive user credentials and related authentication data over unencrypted HTTP connections. The HTTP traffic is not encrypted, allowing an attacker to intercept it.
- CVE-2026-120017Critical
SAP NetWeaver AS ABAP and ABAP Platform do not sufficiently verify incoming authentication assertions under certain configurations. An unauthenticated attacker could submit crafted data to bypass authentication and impersonate arbitrary users, including privileged accounts.
- CVE-2026-109803Critical
SAP NetWeaver Knowledge Management (XML Forms) does not sufficiently restrict the selection of XSL transformations processed by the affected functionality. An authenticated user with access could cause an unauthorized XSL transformation to be processed, potentially leading to arbitrary code execution in the application context.
- CVE-2026-109798Critical
SAP BusinessObjects Business Intelligence Platform (Web Intelligence) does not properly restrict external entity resolution when processing OLAP connection requests. An authenticated attacker could access restricted resources, read sensitive files on the server, and reach internal systems.
Original NVD description (English source)
Snowflake SQLAlchemy versions prior to 1.11.0 contain several security vulnerabilities, including: Improper handling of user-supplied column identifiers in merge operations could allow SQL injection through attacker-controlled input keys. An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Improper literal rendering of bound parameters when building certain Snowflake-specific table creation queries could allow SQL injection. An attacker may be able to exploit this by supplying a crafted string to any application endpoint that passes user-controlled data through the affected query-building API, potentially causing arbitrary data exfiltration within the scope of the connection role. Improper forwarding of connection configuration parameters could allow an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. An attacker may be able to exploit this in deployment environments that accept user-controlled connection parameters, potentially exposing sensitive files accessible to the application process. The fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS