CVE-2026-13746

Name of the Vulnerable Software and Affected Versions Snowflake CLI versions prior to 3.19

Description Improper neutralization of local CLI parameters allows unintended SQL execution. A user can trigger this issue by providing crafted values to the Cortex SQL or object listing command paths, leading the Snowflake CLI to execute unauthorized SQL within the context of the user's session. Exploitation is limited to self-injection since parameters are supplied via local CLI arguments, and the impact is restricted to the privileges of the current session.

Recommendations Update Snowflake CLI to version 3.19.