CVE-2026-13746

{
  "id": "CVE-2026-13746",
  "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea",
  "published": "2026-06-29T16:16:39.403",
  "lastModified": "2026-10-25T21:10:00.770",
  "vulnStatus": "Analyzed",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade."
    },
    {
      "lang": "es",
      "value": "La neutralización incorrecta de parámetros CLI locales en versiones de Snowflake CLI anteriores a la 3.19 permitió la ejecución de SQL no intencionada. Un usuario podría desencadenar este problema al proporcionar valores manipulados a rutas de comandos vulnerables de SQL de Cortex o de listado de objetos, haciendo que Snowflake CLI ejecute SQL no intencionada en el contexto de la sesión de Snowflake de ese usuario. La explotación exitosa está limitada a la autoinyección porque los parámetros vulnerables se suministraron directamente a través de argumentos CLI locales en lugar de a través de archivos de proyecto, repositorios u otras fuentes de entrada externas, y el impacto está limitado a los privilegios ya disponibles para la sesión actual. La solución está disponible en la versión 3.19 de Snowflake CLI, y los usuarios deben actualizar manualmente."
    }
  ],
  "affected": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "affectedData": [
        {
          "vendor": "Snowflake",
          "product": "Snowflake CLI",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "2.0.0",
              "lessThan": "3.19.0",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 3.6,
          "baseSeverity": "LOW",
          "attackVector": "LOCAL",
          "attackComplexity": "HIGH",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 2.5
      },
      {
        "source": "[email protected]",
        "type": "Primary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
          "baseScore": 5.4,
          "baseSeverity": "MEDIUM",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "LOW",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "LOW",
          "integrityImpact": "LOW",
          "availabilityImpact": "NONE"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 2.5
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-06-29T16:21:52.831202Z",
          "id": "CVE-2026-13746",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-89"
        }
      ]
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "operator": "OR",
          "negate": false,
          "cpeMatch": [
            {
              "vulnerable": true,
              "criteria": "cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*",
              "versionStartIncluding": "2.0.0",
              "versionEndExcluding": "3.19.0",
              "matchCriteriaId": "1695A63E-7DEC-484D-A5C9-CDB9917775B2"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory",
      "source": "412d305a-227d-44f9-a262-a31ba44f2aea",
      "tags": [
        "Vendor Advisory"
      ]
    }
  ]
}