CVE-2026-13744: Snowflake CLI SQL Injection Vulnerability

CVE-2026-13744 Overview

CVE-2026-13744 is a SQL injection vulnerability in Snowflake CLI versions prior to 3.19. The flaw stems from improper neutralization of attacker-controlled content processed by the CLI. An attacker who supplies crafted repository content, project configuration, manifest data, or specification input can cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Exploitation is bound by the privileges assigned to the victim's session. Snowflake resolved the issue in Snowflake CLI version 3.19, which users must apply manually.

Critical Impact
Attackers can execute unintended SQL statements within a victim's authenticated Snowflake session, exposing sensitive data and enabling unauthorized modifications.

Affected Products

Snowflake CLI versions prior to 3.19
Deployments consuming untrusted repository content or manifests via Snowflake CLI
Automation pipelines invoking Snowflake CLI with attacker-influenced project or specification files

Discovery Timeline

2026-06-29 - CVE-2026-13744 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13744

Vulnerability Analysis

The vulnerability is classified under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Snowflake CLI fails to properly sanitize content sourced from repositories, project configuration files, manifests, and specification inputs before incorporating that content into SQL statements. When the victim runs a vulnerable command path against attacker-influenced material, the CLI submits SQL that reflects the attacker's payload to the connected Snowflake session.

Because the SQL executes under the victim's authenticated session, the attacker inherits the account roles, warehouses, and object privileges granted to that user. In multi-tenant analytics environments, this can expose datasets across schemas or facilitate lateral operations against warehouses the victim can reach. The attack requires user interaction (UI:R) but no prior authentication to the target system by the attacker.

Root Cause

Snowflake CLI concatenates or interpolates attacker-supplied content into SQL without adequate escaping or parameterization. Repository files, snowflake.yml-style project configuration, application manifests, and Snowpark Container Services specifications are all trusted input surfaces that can carry SQL-influencing tokens through to statement construction.

Attack Vector

The attacker publishes or contributes crafted content to a repository, project bundle, or manifest that a victim will process with Snowflake CLI. When the victim runs a CLI command that reads the payload, the tool issues unintended SQL to Snowflake using the victim's session token. Delivery paths include pull requests against shared project repositories, poisoned template repositories, and third-party manifests consumed during deployment workflows.

A typical exploitation chain does not require synthetic code to illustrate: the attacker seeds a project artifact with content containing SQL metacharacters or statement terminators. The CLI expands that content into a query, and Snowflake executes the resulting composite statement. See the Snowflake Vulnerability Advisory for command paths confirmed affected by the vendor.

Detection Methods for CVE-2026-13744

Indicators of Compromise

Snowflake QUERY_HISTORY entries containing unexpected SQL statements, comment sequences, or stacked queries originating from CLI sessions
Snowflake CLI invocations that process repositories, manifests, or specification files from untrusted or externally contributed sources
Access to tables, roles, or warehouses outside the normal scope of the victim user's automation
CLI runs executed with versions below 3.19 after the vendor advisory publication

Detection Strategies

Correlate Snowflake ACCESS_HISTORY and QUERY_HISTORY with CLI client identifiers to isolate statements produced by the tool
Alert on SQL statements from CLI sessions containing suspicious tokens such as ;, --, /*, or UNION embedded in identifier positions
Baseline the SQL fingerprints emitted by each automation job and flag deviations coinciding with new manifest or project changes

Monitoring Recommendations

Track Snowflake CLI versions deployed across developer workstations, CI runners, and container images, and alert on versions below 3.19
Monitor pull requests and repository changes that modify project configuration, manifests, or specification files consumed by CLI workflows
Forward Snowflake account usage logs to a centralized analytics platform for retention and cross-source correlation

How to Mitigate CVE-2026-13744

Immediate Actions Required

Upgrade Snowflake CLI to version 3.19 or later on every workstation, build agent, and container image
Audit Snowflake QUERY_HISTORY for the last 90 days to identify SQL executed by CLI sessions against untrusted inputs
Restrict Snowflake roles used by CLI automation to the minimum privileges required for their tasks
Rotate credentials and session tokens for users who processed third-party repositories or manifests with vulnerable CLI versions

Patch Information

Snowflake released the fix in Snowflake CLI version 3.19. The upgrade is not automatic. Administrators must manually install the updated release across all environments running the CLI. Refer to the Snowflake Vulnerability Advisory for vendor guidance and release links.

Workarounds

Do not process repositories, manifests, or specification files from untrusted sources with Snowflake CLI until the upgrade is complete
Isolate CLI execution in ephemeral CI runners with scoped Snowflake roles that lack access to sensitive schemas
Require code review and signed commits for any repository content consumed by Snowflake CLI workflows

bash

# Verify installed Snowflake CLI version and upgrade to 3.19 or later
snow --version
pip install --upgrade "snowflake-cli>=3.19"
snow --version