CVE-2026-13746: Snowflake CLI SQL Injection via Unvalidated Parameters

Technical summary

CVE-2026-13746 is an improper neutralization vulnerability (CWE-89) in Snowflake CLI affecting versions prior to 3.19. The flaw exists in Cortex SQL and object listing command parameters that fail to properly sanitize user-supplied input before constructing SQL queries. An authenticated local user can inject malicious SQL by providing crafted arguments directly via the CLI interface. The vulnerability is constrained to self-injection scenarios—exploitation requires direct control of the CLI invocation and cannot be triggered through external configuration files or supply-chain vectors. The attacker's actions are bounded by their existing session privileges.

Business impact

Organizations relying on Snowflake CLI for data operations face a localized privilege escalation risk. A developer or analyst with CLI access could potentially read, modify, or delete data beyond their intended scope—though only within their own authenticated session context. The practical business risk depends on data sensitivity and user access patterns. Teams using automation scripts or CI/CD pipelines that invoke Snowflake CLI with untrusted input face elevated risk. For most organizations, impact is mitigated by standard access controls and the requirement for local command-line execution.

Affected systems

Snowflake CLI versions prior to 3.19 are affected. The vulnerability manifests specifically in Cortex SQL commands and object listing operations. All deployments of vulnerable CLI versions that process user-supplied command-line arguments are potentially at risk. Snowflake's cloud platform itself is not directly affected; only the open-source CLI tool is vulnerable.

Exploitability

Exploitation requires local access and the ability to execute CLI commands with crafted parameters. An attacker cannot trigger this remotely or through passive vectors. The attack surface is limited to users or automation systems that directly invoke vulnerable Snowflake CLI commands. The CVSS score of 3.6 (LOW) reflects the high bar for exploitation: local access, somewhat complex attack conditions, and no ability to escalate beyond existing session permissions. No public exploit code or known active exploitation has been reported.

Remediation

Upgrade Snowflake CLI to version 3.19 or later. The upgrade is manual—it does not occur automatically through package managers or auto-update mechanisms. Organizations should inventory CLI installations across development teams, CI/CD pipelines, and data integration tools, then execute a coordinated upgrade campaign. Verify that deployment automation and container images are also updated to use the patched version.

Patch guidance

Download and install Snowflake CLI version 3.19 from Snowflake's official distribution channels. Verify the version after installation by running 'snow --version' or equivalent. For automated deployments, update package specifications, Docker images, and Infrastructure-as-Code templates to reference version 3.19 or later. Test the patched CLI in a non-production environment to confirm compatibility with existing scripts and workflows before rolling out to production systems.

Detection guidance

Monitor CLI invocation logs for unusual command patterns or SQL injection payloads in Cortex SQL and object listing commands. Look for arguments containing SQL metacharacters or keywords (UNION, DROP, INSERT, etc.) passed to 'snow cortex' or 'snow object list' commands. Examine shell history and audit logs on development systems where CLI is used. Correlate CLI command invocation timestamps with unexpected database activity in Snowflake's query history logs. Alert on execution of CLI commands from unexpected user accounts or at unusual times.

Why prioritize this

Although the CVSS score is low, organizations should prioritize this patch because CLI tools are often central to data pipeline automation and developer workflows. The vulnerability's localized nature means it poses minimal enterprise-wide risk, but affected development teams should upgrade promptly to eliminate the attack surface. The manual upgrade requirement makes this a straightforward remediation task suitable for standard patching cycles rather than emergency response.

Risk score, explained

The CVSS 3.1 score of 3.6 reflects a LOW severity rating based on: (1) Local attack vector (AV:L) requiring direct CLI access; (2) High attack complexity (AC:H), as the attacker must craft specific arguments; (3) Low privilege requirement (PR:L), assuming the user already has CLI access; (4) Limited confidentiality and integrity impact (C:L, I:L) constrained to the user's existing session permissions; (5) No availability impact (A:N). The vulnerability does not meet criteria for CVSS severity escalation despite being exploitable in specific contexts.

Frequently asked questions