CVE-2026-13746: Snowflake CLI SQL Injection Vulnerability

CVE-2026-13746 Overview

CVE-2026-13746 is a SQL injection vulnerability in Snowflake CLI versions prior to 3.19. The flaw stems from improper neutralization of local command-line interface (CLI) parameters passed to Cortex SQL and object listing command paths. A user supplying crafted values through vulnerable CLI arguments can cause Snowflake CLI to execute unintended SQL statements in the context of that user's own Snowflake session. Exploitation is constrained to self-injection because the vulnerable parameters are sourced from local CLI arguments rather than project files, repositories, or other external inputs. The issue is tracked under [CWE-89] and mapped to component snowflake:snowflake_cli.

Critical Impact
Successful exploitation allows unintended SQL execution limited to the privileges of the current Snowflake session, with no privilege escalation across users.

Affected Products

Snowflake CLI versions prior to 3.19
Cortex SQL command paths in Snowflake CLI
Object listing command paths in Snowflake CLI

Discovery Timeline

2026-06-29 - CVE-2026-13746 published to the National Vulnerability Database (NVD)
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13746

Vulnerability Analysis

The vulnerability resides in the argument-handling logic of specific Snowflake CLI command paths. When users invoke Cortex SQL commands or object listing operations, the CLI incorporates values from local arguments into SQL statements sent to Snowflake without adequate neutralization. Attacker-controlled fragments in those parameters become part of the executed query, producing SQL injection [CWE-89].

Because the injected content only reaches Snowflake through the invoking user's authenticated session, the resulting execution runs with that session's existing privileges. There is no cross-user privilege boundary crossed by the flaw itself.

Root Cause

The root cause is improper neutralization of special elements used in an SQL command. Vulnerable Cortex SQL and object listing command paths concatenate or interpolate CLI-provided values into SQL strings rather than binding them as parameters. Any character that terminates or extends an SQL clause is passed through to the Snowflake backend, allowing statement composition beyond the developer-intended query shape.

Attack Vector

The attack vector is local CLI input from the user running Snowflake CLI. An attacker cannot inject SQL through project files, remote repositories, configuration sources, or other external channels — only through direct CLI arguments supplied to the vulnerable commands. This constrains the vulnerability to self-injection scenarios, such as a user pasting untrusted values into a command line, or a wrapper script forwarding tainted input to CLI parameters. Confidentiality and integrity impacts are limited to data accessible by the current Snowflake session, and availability is not affected.

No public proof-of-concept exploit code is available for CVE-2026-13746. See the Snowflake CLI Vulnerability Advisory for vendor-provided technical details.

Detection Methods for CVE-2026-13746

Indicators of Compromise

Snowflake CLI binaries reporting a version earlier than 3.19 in inventory or endpoint telemetry.
Shell history entries containing Cortex SQL or object listing subcommands with unusual quoting, semicolons, or SQL keywords inside argument values.
Snowflake QUERY_HISTORY entries originating from CLI sessions containing SQL syntax that does not match expected command templates.

Detection Strategies

Query Snowflake ACCOUNT_USAGE.QUERY_HISTORY for statements tagged with the CLI client identifier that contain unexpected DDL, DML, or stacked statements.
Compare package inventories against the fixed version 3.19 across developer workstations, CI runners, and jump hosts where Snowflake CLI is installed.
Review wrapper scripts and CI pipelines that forward untrusted variables into snow cortex or snow object list invocations.

Monitoring Recommendations

Enable Snowflake query tagging for CLI-invoked sessions to distinguish CLI-generated SQL from application traffic.
Alert on Snowflake sessions that execute SQL categories outside the expected scope of Cortex or object listing commands.
Track Snowflake CLI version telemetry on managed endpoints and flag hosts remaining below 3.19 after patch rollout.

How to Mitigate CVE-2026-13746

Immediate Actions Required

Upgrade Snowflake CLI to version 3.19 or later on every workstation, build agent, and server that runs the tool. Manual upgrade is required.
Audit shell wrappers, Makefiles, and CI/CD pipelines that pass user-controlled input into Snowflake CLI Cortex SQL or object listing arguments.
Restrict Snowflake role privileges available to CLI-invoked sessions in line with least privilege, reducing what a self-injection can reach.

Patch Information

Snowflake has released Snowflake CLI version 3.19, which remediates the improper neutralization in the affected Cortex SQL and object listing command paths. Users must upgrade manually — no automatic update path is provided. Refer to the Snowflake CLI Vulnerability Advisory for release details and upgrade guidance.

Workarounds

Avoid passing untrusted or externally sourced values as arguments to Snowflake CLI Cortex SQL or object listing commands until upgrading.
Use dedicated low-privilege Snowflake roles for interactive CLI sessions to limit the blast radius of any injected SQL.
Where feasible, replace vulnerable command invocations with parameterized SQL executed through the Snowflake Python or SQL API instead of CLI argument interpolation.

bash

# Configuration example: verify and upgrade Snowflake CLI to the fixed version
snow --version
pip install --upgrade "snowflake-cli>=3.19"
snow --version