CVE-2026-13746: Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-06-29 · updated 2026-10-25
Weakness: CWE-89

Description

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

Affected products

Snowflake CLI: from 2.0.0 before 3.19.0 — fixed in 3.19.0

How to fix

Upgrade to a fixed version: Snowflake CLI 3.19.0. Check the vendor advisory for mitigations.

References

https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory

Get alerted when CVE-2026-13746 or the next vulnerability affects your stack