What is CVE-2026-13746?

CVE-2026-13746 is a low-severity vulnerability in Snowflake Cli, classified under SQL Injection. CVSS score: 3.6/10. Published 2026-06-29.

How severe is CVE-2026-13746?

Low severity. CVSS v3 base score is 3.6 out of 10.

SQL Injection in Snowflake Cli

CVE-2026-13746

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

Vulnerability class: SQL Injection

EPSS: 0.001 (3.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 3.6 (Low). Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N.

Affected products

Snowflake Cli — versions 2.0.0
Snowflake Snowflake_cli

Weakness classification (CWE)

CWE-89 — SQL Injection

References

412d305a-227d-44f9-a262-a31ba44f2aea (Vendor Advisory)

Frequently asked questions

What is CVE-2026-13746?: CVE-2026-13746 is a low-severity vulnerability in Snowflake Cli, classified under SQL Injection. CVSS score: 3.6/10. Published 2026-06-29.
How severe is CVE-2026-13746?: Low severity. CVSS v3 base score is 3.6 out of 10.