Get real-time updates on Telegram
CVE-2026-15736: Snowflake SQLAlchemy 1.1.6 to before 1.11.0
CVE-2026-15736. CVSS 3.1 base score 8.3 (HIGH, Source advisory). EPSS 0.00377 (percentile 0.30564), scored 24-Oct-2026.
Affected technology
Snowflake SQLAlchemy · 1.1.6 to before 1.11.0
Snowflake
Description’s affected range: versions prior to 1.11.0
Component: Not specified by the source
Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required
What an attacker can do
An attacker may be able to exploit this through request field names in a dynamic upsert endpoint, potentially enabling read access to data visible to the application's database role or modification of values within the same MERGE statement. Source advisory’s CVSS 3.1 assessment (base score 8.3/10) rates confidentiality and integrity impact as high; availability impact as low.
- CWE
- CWE-73, CWE-89
- CCR priority
- 33.3 /100 (P4)
- CVSS 3.1
- 8.3 /10 · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L · Source advisory
- EPSS
- 0.00377 · percentile 0.30564 · 2026-10-24
- KEV
- no
Provenance
- NVD CVE API 2.0 · Source record · observed 2026-10-25 01:28:19.133527+00:00 UTC
Stable permalink: https://cybercodered.org/item/cve-cve-2026-15736.html