Vulnerabilidades do Snowflake Snowflake Cli

🔔 Criar alerta RSS Verificador de versão

CVEs publicadas que afetam Snowflake Snowflake Cli: 7 registro(s), com versões afetadas e correções.
cpe:2.3:a:snowflake:snowflake_cli

CVE-2026-13752 Alta · 8.0 CWE-89 29/06/2026

Snowflake CLI SQL Injection Through Improper Neutralization of Parameters in Secret Creation and SPCS Service Log Commands

Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. An attacker could exploit this by supplying crafted values to vulnerable command paths, causing Snowflake CLI to execute unintended SQL in the context of the user’s Snowflake session. Successful exploitation required crafted values to reach vulnerable parameters, including through socially engineered input, malicious repository configuration, or compromised automation feeding external values into the CLI, and impact is limited by the privileges assigned to the active session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

CVE-2026-13751 Crítica · 9.6 CWE-829 29/06/2026

Server-Side Request Forgery no Snowflake CLI via Referências Remotas em SQL

Tratamento impróprio de referências remotas não confiáveis nas versões do Snowflake CLI anteriores à 3.19 permitiu server-side request forgery. As diretivas !source/!load do leitor de instruções SQL podiam referenciar URLs remotas que eram recuperadas em tempo de execução sem restrição suficiente quanto ao destino da requisição. Ao fornecer conteúdo SQL elaborado processado por um caminho de comando vulnerável, um atacante poderia fazer com que o ambiente da vítima emitisse requisições de saída não previstas para locais de rede internos ou não públicos, e poderia fazer com que conteúdo SQL remoto fosse recuperado e executado no contexto da sessão do usuário vítima. A exploração bem-sucedida exige que a vítima processe conteúdo controlado pelo atacante por meio de um caminho de comando vulnerável e é limitada pelos privilégios disponíveis àquela sessão e ambiente. A correção está disponível no Snowflake CLI versão 3.19, que adiciona uma opção para desabilitar a recuperação de URLs remotas.

CVE-2026-13750 Média · 5.5 CWE-532 29/06/2026

Snowflake CLI Sensitive Credential Exposure Through Debug Logging

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

CVE-2026-13749 Alta · 8.8 CWE-94 29/06/2026

Snowflake CLI Arbitrary Code Execution via Snowpark Annotation Processor Template Injection

Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior to 3.19 allowed arbitrary code execution during application bundling or deployment. An attacker could exploit this by supplying crafted project content that is interpolated into generated Python code, causing Snowflake CLI to execute attacker-controlled code in the local context of the user running the CLI. Successful exploitation requires the victim to run the relevant bundling or deployment workflow against attacker-controlled project content, and any resulting code runs with the privileges of that local execution context. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

CVE-2026-13748 Média · 6.3 CWE-22 29/06/2026

Snowflake CLI Arbitrary Local File Read and Exfiltration Through Improper File Path Restriction

Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local file content to be read and transmitted to Snowflake services. An attacker could exploit this by supplying crafted repository or project content that referenced files outside the intended project boundary, causing Snowflake CLI to read local files and upload or embed their contents during deployment or SQL template processing. Successful exploitation required the victim to process attacker-controlled project content, and retrieval of exfiltrated data depended on access to the victim's Snowflake account artifacts such as query history or uploaded stage content. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

CVE-2026-13746 Média · 5.4 CWE-89 29/06/2026

Snowflake CLI SQL Injection Through Improper Neutralization of Local CLI Parameters

Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. A user could trigger this issue by supplying crafted values to vulnerable Cortex SQL or object listing command paths, causing Snowflake CLI to execute unintended SQL in the context of that user's Snowflake session. Successful exploitation is constrained to self-injection because the vulnerable parameters were supplied directly through local CLI arguments rather than through project files, repositories, or other external input sources, and impact is limited to the privileges already available to the current session. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

CVE-2026-13744 Alta · 8.8 CWE-89 29/06/2026

Snowflake CLI SQL Injection Through Improper Neutralization of User-Controlled Input

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.