CVE-2026-13748: Snowflake CLI Path Traversal – Local File Disclosure

Technical summary

CVE-2026-13748 stems from improper validation of file path resolution in Snowflake CLI, enabling path traversal attacks (CWE-22, CWE-61, CWE-73). When processing project content—including repository configurations or SQL templates—the CLI fails to restrict file access to the intended project boundary. An attacker can craft malicious project artifacts with path traversal sequences (e.g., '../../../etc/passwd') that the CLI will resolve and read. The disclosed content is then embedded in deployment artifacts or SQL processing outputs, which are subsequently uploaded to or logged within Snowflake services. Data exfiltration success hinges on the attacker's ability to access the victim's Snowflake query history, stage files, or deployment logs where the sensitive data would be visible.

Business impact

Organizations using Snowflake CLI for infrastructure-as-code deployments face a confidentiality risk if developers process untrusted project configurations. Exfiltration could expose sensitive local files such as API keys, credentials, configuration files, or other secrets stored on developer machines. The practical blast radius is limited by the requirement for user interaction—a developer must manually clone or load an attacker-controlled project—and by the attacker's need for subsequent access to the victim's Snowflake account to view exfiltrated content. DevOps and data engineering teams are the primary concern; widespread automated CI/CD use without manual review of project sources increases risk.

Affected systems

Snowflake CLI versions 3.18 and earlier are vulnerable. The fix is available in version 3.19 and later. Any installation using the affected versions in environments where developers work with external or untrusted repository sources is at risk.

Exploitability

The vulnerability requires user interaction (a developer must process attacker-supplied project content) and is rated MEDIUM severity (CVSS 3.1 score: 6.3) with a vector of AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N. This reflects local attack surface, low attack complexity, and high confidentiality impact, but no privilege requirement and no integrity or availability impact. The attack is not trivial—it demands social engineering or supply-chain compromise to place malicious project files into a developer's workflow—but is feasible for targeted attacks against organizations that use Snowflake CLI with external dependencies.

Remediation

Upgrade Snowflake CLI to version 3.19 or later immediately. No workarounds are available; patching is the only remediation. Organizations should verify that developers and automation systems are running the patched version.

Patch guidance

Download and install Snowflake CLI version 3.19 from the official Snowflake repository or package manager. The upgrade is manual and does not require Snowflake account changes. Before upgrading in production CI/CD pipelines, test in a non-critical environment to confirm compatibility with your deployment workflows. Verify the installed version using 'snow --version' or equivalent command after installation.

Detection guidance

Monitor for unusual file read activity on developer and CI/CD machines running Snowflake CLI, particularly access to files outside project directories. If your organization logs Snowflake query history and stage uploads, search for suspicious content that may have been exfiltrated from local systems (e.g., references to '/etc/', home directory paths, or config file content). Review Snowflake deployment logs and query results for evidence of local file paths or unexpected content injection.

Why prioritize this

While the CVSS score is MEDIUM, the vulnerability should be addressed promptly because: (1) it can exfiltrate sensitive credentials and configuration data from developer machines, (2) the fix is straightforward and non-disruptive, and (3) exploitation depends on supply-chain or social engineering rather than a pre-existing vulnerability in the target system. Organizations with strict secret management practices and those that vet external dependencies before use have lower practical risk.

Risk score, explained

The CVSS 3.1 score of 6.3 MEDIUM reflects the local attack vector, requirement for user interaction, and high confidentiality impact balanced against the lack of integrity or availability impact and the absence of privilege escalation. The score appropriately penalizes the user-interaction requirement while recognizing that exfiltration of local secrets is a serious confidentiality breach.

Frequently asked questions