CVE-2026-15736: Snowflake SQLAlchemy SQL Injection and Local File Disclosure Vulnerabilities
Summary
CVE-2026-15736: Snowflake SQLAlchemy affected by SQL injection and local file disclosure vulnerabilities. Affects snowflake-sqlalchemy versions >= 1.1.6, < 1.11.0. Fixed in 1.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Snowflake SQLAlchemy is a Python library that provides an interface for connecting to Snowflake, a cloud-based data warehousing service. It allows developers to execute SQL queries and manage data within Snowflake using SQLAlchemy's ORM capabilities. The library is widely used for its ease of integration with Python applications and its ability to handle complex data operations. However, certain versions of Snowflake SQLAlchemy prior to 1.11.0 are vulnerable to critical security issues that can lead to SQL injection and local file disclosure.
Vulnerability Detail
The vulnerabilities in Snowflake SQLAlchemy stem from improper handling of user-supplied input during SQL operations. Specifically, the library fails to adequately sanitize column identifiers in merge operations, allowing attackers to inject malicious SQL code through crafted input keys. This could lead to unauthorized data access or modification. Additionally, the library's handling of bound parameters in specific table creation queries is flawed, enabling potential SQL injection attacks that could result in arbitrary data exfiltration. Furthermore, the library's forwarding of connection parameters can be exploited to read arbitrary local files, exposing sensitive information to attackers. These vulnerabilities pose significant risks to applications using affected versions of the library.
How To Fix
Latest published version: 2.0.0 as of 23 Oct 2026
pip install --upgrade "snowflake-sqlalchemy==2.0.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.11.0
This is the first release that contains the fix.
pip install --upgrade "snowflake-sqlalchemy==1.11.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using dynamic input for column identifiers in merge operations and ensure that any user-controlled data passed to the query-building API is properly sanitized. However, upgrading to the patched version is strongly recommended for long-term security.
Conclusion
The vulnerabilities in Snowflake SQLAlchemy versions prior to 1.11.0 pose significant risks, including SQL injection and local file disclosure. Users are strongly advised to upgrade to the latest version to mitigate these risks. Regular monitoring of dependencies using tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for snowflake-sqlalchemy →
FAQ
Versions prior to 1.11.0 are affected by these vulnerabilities.
Attackers can exploit these vulnerabilities to perform SQL injection attacks, leading to unauthorized data access and modification, as well as local file disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.3, indicating a high severity level.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the Pipfile.lock.
