CVE-2026-13751: Snowflake CLI SSRF Vulnerability – Patch to 3.19

Technical summary

CVE-2026-13751 is a server-side request forgery vulnerability in Snowflake CLI's SQL statement reader. The !source and !load directives, which allow inclusion of remote SQL content via URL references, lack sufficient validation of request destinations. This permits an attacker to craft SQL statements that, when processed by a vulnerable Snowflake CLI version, cause the CLI to issue requests to unintended endpoints—including internal network resources or private IP ranges—and to fetch and execute arbitrary SQL content. The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere) and CWE-918 (Server-Side Request Forgery). Remediation involves upgrading to Snowflake CLI 3.19 or later, which introduces a configuration option to disable remote URL retrieval entirely.

Business impact

This vulnerability poses a moderate risk to organizations using Snowflake CLI in development or automation workflows. A successful attack could expose internal network topology, bypass firewall restrictions, or lead to unintended SQL execution within a user's Snowflake session. In collaborative environments or CI/CD pipelines where SQL scripts are shared or auto-processed, the risk surface expands if untrusted sources can inject malicious SQL. The impact remains scoped to the privileges of the user running the CLI, limiting exposure for read-only accounts but creating risk for administrative sessions.

Affected systems

Snowflake CLI versions prior to 3.19 are vulnerable. Any organization deploying Snowflake CLI in development, testing, or automation contexts should audit their installed versions. Risk is elevated in environments where SQL scripts originate from multiple sources or are auto-executed by service accounts with broad Snowflake permissions.

Exploitability

Exploitation requires user interaction—specifically, the victim must process attacker-controlled SQL content through a vulnerable CLI command path. This is not a direct network or unauthenticated attack. An attacker would need to deliver malicious SQL via email, code repository, shared storage, or other channels. Once a user processes such content, the CLI silently honors the !source or !load directives, making this a social engineering concern. The local attack vector and high user interaction requirement lower the baseline severity, though the attack is straightforward once the user is engaged.

Remediation

Upgrade Snowflake CLI to version 3.19 or later. Version 3.19 introduces a configuration option to disable remote URL retrieval, allowing organizations to adopt a deny-by-default posture. In addition to patching, implement security controls: (1) restrict CLI usage and SQL script execution to trusted, controlled environments; (2) educate users on the risks of processing SQL from untrusted sources; (3) use code review and static analysis on SQL scripts before execution; (4) consider deploying Snowflake CLI in sandboxed or air-gapped environments if possible.

Patch guidance

Upgrade all instances of Snowflake CLI to version 3.19 or later. Verify the upgrade with 'snowflake --version' and test against your SQL workflows to confirm compatibility. The patch includes a new option to globally disable remote URL retrieval; consult the Snowflake CLI release notes for activation steps. No database-side changes are required. For organizations unable to patch immediately, temporarily restrict SQL script sources to known, approved repositories and disable CLI access from user workstations.

Detection guidance

Monitor Snowflake CLI logs and shell history for use of !source or !load directives pointing to external or suspicious URLs. Look for unexpected outbound connections initiated by Snowflake CLI processes (particularly to private IP ranges or internal hostnames). In CI/CD pipelines, audit SQL files for remote directives before execution. Network-level detection is challenging due to legitimate use cases, but SIEM rules can flag CLI processes making requests to non-whitelisted internal resources. Audit access to Snowflake user session logs for unexpected SQL execution patterns that may indicate remote content inclusion.

Why prioritize this

This vulnerability merits prompt but not emergency remediation. The CVSS score of 4.1 (MEDIUM) reflects the requirement for user interaction and local attack surface. However, the combination of reliable exploitability (once a user is tricked), potential for lateral movement into internal networks, and prevalence of shared SQL scripts in modern data teams justifies timely patching. Organizations with heavy reliance on automated SQL execution or those handling sensitive data should prioritize this within their standard patch cycle (typically 30–60 days). Lower-risk environments can extend timelines slightly but should implement the disable-remote-URLs control as a compensating measure.

Risk score, explained

The CVSS 3.1 score of 4.1 (MEDIUM) is driven by: Attack Vector: Local (the user must invoke the CLI); Attack Complexity: High (specific crafted SQL and user action required); Privileges Required: None (no pre-existing permissions needed); User Interaction: Required (victim must process attacker content); Scope: Changed (can affect internal network resources outside the CLI's normal scope); Confidentiality Impact: Low (exposure of internal network info or session data); Integrity Impact: Low (execution of remote SQL). The score appropriately reflects a real but not critical risk—not an unauthenticated remote code execution, but a plausible social engineering attack with tangible consequences for data integrity and network security.

Frequently asked questions