CVE-2026-13746 Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters

Low 3.6 Published 29 Jun 2026 Updated 29 Jun 2026

Attackers can execute unintended SQL via crafted CLI arguments, limited to self-injection within the user's session privileges.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-13746?

CVE-2026-13746 is a low-severity SQL injection vulnerability in Snowflake CLI, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

Weakness: CWE-89

Which versions are affected by CVE-2026-13746?

It affects 1 product.

Products include Snowflake Snowflake Cli.

How do I fix CVE-2026-13746?

No fix has been published for CVE-2026-13746 yet. Limit exposure of the affected software until one is available.

Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.

Is CVE-2026-13746 being exploited?

There is no known exploitation of CVE-2026-13746 in the wild and no public exploit code.

Sources

Also known as GHSA-656q-44hg-7hm7.