CVE-2026-15736 affects Snowflake SQLAlchemy versions prior to 1.11.0 and involves several security issues: (1) improper neutralization of user-supplied column identifiers in MERGE operations enabling SQL injection via attacker-controlled input keys, potentially allowing read or modification of data within the same MERGE statement; (2) improper literal rendering of bound parameters in Snowflake-specific table creation queries, allowing SQL injection through crafted strings passed to query-building APIs; (3) improper forwarding of connection configuration parameters that could lead to reading arbitrary local files and transmitting their contents to attacker-controlled endpoints. These vulnerabilities arise from insufficient input validation and unsafe handling of user-controlled data in dynamic SQL query construction and connection parameter processing. The vendor has released version 1.11.0 containing fixes for these issues. Users must manually upgrade to this version to remediate the vulnerabilities. The CVSS 3.1 score is 8.3 (High), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and high confidentiality and integrity impact with low availability impact. The product is a cloud service, but the patch requires manual upgrade by users.

Successful exploitation can lead to SQL injection attacks allowing unauthorized reading and modification of data accessible to the application's database role. Additionally, attackers may exfiltrate arbitrary local files from the deployment environment if user-controlled connection parameters are accepted. This compromises confidentiality and integrity of data and may expose sensitive files accessible to the application process. The overall impact is high due to potential data exposure and modification.

A fix is available in Snowflake SQLAlchemy version 1.11.0. Users must manually upgrade to this version to remediate the vulnerabilities. Since this is a library used in deployment environments, patching requires updating the dependency in application environments. There is no indication that the vendor manages remediation automatically for this cloud service; therefore, manual upgrade is necessary. No other vendor advisory mitigation instructions are provided.