CVE-2026-13746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-13746", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "state": "PUBLISHED", "assignerShortName": "SNOWFLAKE", "dateReserved": "2026-06-29T15:41:42.790Z", "datePublished": "2026-06-29T15:51:57.399Z", "dateUpdated": "2026-06-29T16:21:58.031Z"}, "containers": {"cna": {"title": "Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters", "descriptions": [{"lang": "en", "value": "Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade."}], "affected": [{"vendor": "Snowflake", "product": "Snowflake CLI", "versions": [{"version": "2.0.0", "lessThan": "3.19.0", "versionType": "semver", "status": "affected"}], "defaultStatus": "unaffected"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "type": "CWE"}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "references": [{"url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory", "name": "Snowflake CLI Vulnerability Advisory"}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-06-29T15:51:57.399Z"}, "x_generator": {"engine": "cvelib 1.8.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-06-29T16:21:52.831202Z", "id": "CVE-2026-13746", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T16:21:58.031Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-13746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T16:21:52.831202Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-06-29T16:21:54.967Z"}}], "cna": {"title": "Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters", "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.6, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Snowflake", "product": "Snowflake CLI", "versions": [{"status": "affected", "version": "2.0.0", "lessThan": "3.19.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory", "name": "Snowflake CLI Vulnerability Advisory"}], "x_generator": {"engine": "cvelib 1.8.0"}, "descriptions": [{"lang": "en", "value": "Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "shortName": "SNOWFLAKE", "dateUpdated": "2026-06-29T15:51:57.399Z"}}}, "cveMetadata": {"cveId": "CVE-2026-13746", "state": "PUBLISHED", "dateUpdated": "2026-06-29T16:21:58.031Z", "dateReserved": "2026-06-29T15:41:42.790Z", "assignerOrgId": "412d305a-227d-44f9-a262-a31ba44f2aea", "datePublished": "2026-06-29T15:51:57.399Z", "assignerShortName": "SNOWFLAKE"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Snowflake CLI", "vendor": "Snowflake", "versions": [{"lessThan": "3.19.0", "status": "affected", "version": "2.0.0", "versionType": "semver"}]}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*", "matchCriteriaId": "1695A63E-7DEC-484D-A5C9-CDB9917775B2", "versionEndExcluding": "3.19.0", "versionStartIncluding": "2.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade."}, {"lang": "es", "value": "La neutralizaci\u00f3n incorrecta de par\u00e1metros CLI locales en versiones de Snowflake CLI anteriores a la 3.19 permiti\u00f3 la ejecuci\u00f3n de SQL no intencionada. Un usuario podr\u00eda desencadenar este problema al proporcionar valores manipulados a rutas de comandos vulnerables de SQL de Cortex o de listado de objetos, haciendo que Snowflake CLI ejecute SQL no intencionada en el contexto de la sesi\u00f3n de Snowflake de ese usuario. La explotaci\u00f3n exitosa est\u00e1 limitada a la autoinyecci\u00f3n porque los par\u00e1metros vulnerables se suministraron directamente a trav\u00e9s de argumentos CLI locales en lugar de a trav\u00e9s de archivos de proyecto, repositorios u otras fuentes de entrada externas, y el impacto est\u00e1 limitado a los privilegios ya disponibles para la sesi\u00f3n actual. La soluci\u00f3n est\u00e1 disponible en la versi\u00f3n 3.19 de Snowflake CLI, y los usuarios deben actualizar manualmente."}], "id": "CVE-2026-13746", "lastModified": "2026-10-25T21:10:00.770", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.6, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 2.5, "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13746", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-06-29T16:21:52.831202Z", "version": "2.0.3"}}]}, "published": "2026-06-29T16:16:39.403", "references": [{"source": "412d305a-227d-44f9-a262-a31ba44f2aea", "tags": ["Vendor Advisory"], "url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory"}], "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,3.19.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Snowflake CLI", "source": "cna", "vendor": "Snowflake"}, "product": "snowflake_cli", "vendor": "snowflake"}], "created": "2026-06-29T17:30:06.126521+00:00", "updated": "2026-07-01T10:04:18.469954+00:00", "vendors": ["snowflake", "snowflake$PRODUCT$snowflake_cli"]}