CVE-2026-13750: Snowflake CLI Information Disclosure Flaw

CVE-2026-13750 Overview

CVE-2026-13750 is an information disclosure vulnerability in Snowflake CLI versions prior to 3.19. The command-line interface writes plaintext credentials to persistent local debug logs during normal operation. Exposed material includes passwords, authentication tokens, and private key data associated with the active connection context.

An attacker with read access to the affected user's local log files can harvest these credentials without triggering application-level safeguards. The flaw is classified under CWE-532: Insertion of Sensitive Information into Log File. Snowflake addressed the issue in Snowflake CLI version 3.19, which requires a manual upgrade.

Critical Impact
Local attackers or malicious processes with file system read access can extract plaintext Snowflake credentials from CLI debug logs, enabling account takeover and unauthorized access to Snowflake data warehouses.

Affected Products

Snowflake CLI versions prior to 3.19
Environments where debug logging is enabled during authenticated CLI sessions
Systems where local log files are accessible to other users or backup processes

Discovery Timeline

2026-06-29 - CVE-2026-13750 published to NVD
2026-06-30 - Last updated in NVD database

Technical Details for CVE-2026-13750

Vulnerability Analysis

Snowflake CLI is a command-line tool used by developers and data engineers to interact with Snowflake accounts, execute SQL, and manage objects. The CLI supports multiple authentication methods including password, OAuth tokens, and key-pair authentication.

During CLI operations, the tool writes diagnostic information to local debug log files. In versions prior to 3.19, the logging subsystem failed to redact sensitive fields from the connection context before serialization. Credentials that were passed to the CLI, either directly or through configuration files, were emitted verbatim into these logs.

The logs persist on disk between sessions. Any process or user with read permissions on the log directory can enumerate historical credentials, including material for accounts no longer used interactively.

Root Cause

The root cause is missing sanitization in the debug logging pipeline. Credential fields such as password, token, and private_key were included in serialized connection state written to log output. The application relied on the assumption that debug logs were transient and locally trusted, an assumption that fails when logs persist and endpoints are shared or backed up.

Attack Vector

Exploitation requires local read access to the affected user's log files. Attack scenarios include a lower-privileged local user reading world-readable log paths, malware running under a user context enumerating credential caches, or exfiltration of backup archives that contain the log directory. The attack requires no user interaction, and the affected credentials retain validity until rotated on the Snowflake account.

Successful exploitation grants the attacker Snowflake authentication material equivalent to the CLI user, permitting queries, data exfiltration, or lateral movement within the Snowflake environment. See the Snowflake Security Advisory for vendor details.

Detection Methods for CVE-2026-13750

Indicators of Compromise

Snowflake CLI debug log files containing plaintext strings matching password=, token=, private_key, or authenticator fields
Unexpected read access events on Snowflake CLI configuration and log directories from processes other than snow
Snowflake account login events from IP addresses or user agents inconsistent with the authorized CLI user

Detection Strategies

Scan endpoints for Snowflake CLI installations at versions below 3.19 and inventory log file locations
Grep local log directories for credential patterns and flag any hits for immediate rotation
Correlate Snowflake LOGIN_HISTORY and QUERY_HISTORY audit data with expected CLI usage windows to identify anomalous sessions

Monitoring Recommendations

Alert on file access to Snowflake CLI log directories by non-owner processes
Monitor Snowflake account activity for logins from new client identifiers or geolocations
Track CLI version telemetry across developer endpoints to confirm upgrade coverage

How to Mitigate CVE-2026-13750

Immediate Actions Required

Upgrade Snowflake CLI to version 3.19 or later on every affected endpoint
Rotate all Snowflake credentials, tokens, and key pairs that were used with vulnerable CLI versions
Delete existing debug log files that may contain plaintext credential material
Restrict file system permissions on the CLI log directory to the owning user only

Patch Information

The fix is available in Snowflake CLI version 3.19. The upgrade is not automatic. Administrators must manually update the CLI package through their chosen installation method, whether pip, Homebrew, or the vendor installer. Refer to the Snowflake Security Advisory for release details.

Workarounds

Disable debug logging on the Snowflake CLI until the upgrade is applied
Switch to key-pair authentication with the private key stored outside any directory that the CLI logs to, and rotate keys after upgrade
Configure endpoint controls to prevent unauthorized processes from reading user home directories

bash

# Upgrade Snowflake CLI to a fixed version and remove stale debug logs
pip install --upgrade "snowflake-cli>=3.19"
snow --version

# Remove historical debug logs that may contain plaintext credentials
rm -f ~/.snowflake/logs/*.log
chmod 700 ~/.snowflake ~/.snowflake/logs