CVE-2026-13749: Snowflake CLI RCE Vulnerability

CVE-2026-13749 Overview

CVE-2026-13749 is a code injection vulnerability in Snowflake CLI versions prior to 3.19. The flaw resides in the Snowpark annotation processor callback template, which fails to neutralize project content before interpolating it into generated Python code. Attackers can supply crafted project files that execute arbitrary code when a victim runs the bundling or deployment workflow. The code executes in the local context of the user running the CLI, inheriting that user's privileges. Snowflake released the fix in Snowflake CLI 3.19, and users must manually upgrade to remediate the issue.

Critical Impact
Arbitrary code execution on developer or CI/CD systems when Snowflake CLI processes attacker-controlled project content during bundling or deployment.

Affected Products

Snowflake CLI versions prior to 3.19
Snowpark applications built or deployed with vulnerable CLI versions
CI/CD pipelines invoking Snowflake CLI bundling or deployment commands

Discovery Timeline

2026-06-29 - CVE-2026-13749 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13749

Vulnerability Analysis

The vulnerability is classified as improper control of code generation, tracked under CWE-94. Snowflake CLI generates Python code dynamically when processing Snowpark annotations during application bundling. The annotation processor callback template interpolates values from project content directly into the generated source without escaping or validation. An attacker who controls project files can inject Python expressions that execute when the template renders. Execution occurs during routine developer workflows such as snow snowpark build or deployment commands, making the attack surface any environment that processes untrusted Snowpark projects.

Root Cause

The root cause is unsafe string interpolation in the Snowpark annotation processor callback template. Project-supplied identifiers, decorator arguments, or metadata reach the code generator without neutralization. Because the generator emits executable Python rather than data, injected content becomes program logic. This pattern is a canonical instance of CWE-94, where the boundary between data and code collapses during code generation.

Attack Vector

Exploitation requires user interaction. An attacker publishes or contributes a Snowpark project containing malicious annotations, function signatures, or metadata. A victim clones or receives the project and runs a Snowflake CLI bundling or deployment command against it. The CLI interpolates the malicious content into generated Python and executes it locally. The resulting process runs with the victim's user privileges and can read environment variables, extract Snowflake credentials, tamper with source files, or pivot into connected cloud accounts.

No public proof-of-concept exploit is available. The vulnerability has not been observed in active exploitation and is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-13749

Indicators of Compromise

Snowflake CLI processes spawning unexpected child processes such as sh, bash, powershell.exe, curl, or wget during snow snowpark build or snow app workflows.
Outbound network connections from developer workstations or CI runners initiated by the Python interpreter invoked by Snowflake CLI.
Unexpected file writes to home directories, SSH configuration paths, or credential stores immediately after running Snowflake CLI commands.

Detection Strategies

Monitor process telemetry for snow CLI invocations that produce anomalous child processes or spawn interactive shells.
Inspect Snowpark project repositories for unusual characters, quote-breaking sequences, or embedded Python statements within annotations and decorator arguments.
Correlate Snowflake CLI execution events with subsequent access to credential files such as ~/.snowflake/config.toml or environment dumps.

Monitoring Recommendations

Alert on Snowflake CLI processes that establish outbound connections to non-Snowflake domains during bundling or deployment.
Track version strings of the snow binary across developer endpoints and CI infrastructure to identify hosts running versions prior to 3.19.
Log and review all Snowpark deployment activity in CI/CD systems, focusing on pipelines that consume external or contributor-supplied project content.

How to Mitigate CVE-2026-13749

Immediate Actions Required

Upgrade Snowflake CLI to version 3.19 or later on all developer workstations, build servers, and CI/CD runners.
Audit CI/CD pipelines that invoke snow commands against externally supplied Snowpark project content.
Rotate Snowflake credentials that were accessible from any host that ran a vulnerable Snowflake CLI against untrusted project content.

Patch Information

Snowflake released the fix in Snowflake CLI version 3.19. The upgrade is not automatic; users must manually install the updated release. Refer to the Snowflake CLI Vulnerability Advisory for vendor guidance and release notes.

Workarounds

Do not run Snowflake CLI bundling or deployment commands against Snowpark projects from untrusted sources until the upgrade is complete.
Execute Snowflake CLI workflows inside ephemeral containers or sandboxed CI runners that lack access to production credentials.
Restrict write access to Snowpark project repositories and require code review for changes to annotations, decorators, and function metadata.

bash

# Verify installed version and upgrade to the patched release
snow --version
pip install --upgrade "snowflake-cli>=3.19"
snow --version