Improper Neutralization in Snowflake CLI Allows Unauthorized SQL Execution

CVE-2026-13746

What is CVE-2026-13746?

An improper neutralization of local Command Line Interface (CLI) parameters in Snowflake CLI versions prior to 3.19 created a vulnerability that permitted unintended SQL execution. By supplying specially crafted inputs to vulnerable command paths, users could inadvertently trigger the execution of unintended SQL within their own Snowflake session. The exploitation is confined to self-injection since the parameters are provided directly through local CLI arguments, without reliance on external files or repositories. This limits the impact to the existing privileges of the user’s session. Users are encouraged to upgrade to Snowflake CLI version 3.19 or later to mitigate the issue.

References