Executive brief
Snowflake CLI is a command-line tool used by developers and DevOps teams to manage Snowflake database resources. Versions prior to 3.27.0 fail to properly validate user-supplied input before inserting it into SQL queries, allowing attackers with repository write access or the ability to control CLI input to execute arbitrary SQL statements with the privileges of the configured Snowflake service account role. This could lead to unauthorized data access, modification, or deletion depending on the role's permissions.
Technical details
The vulnerability is an improper input validation flaw (CWE-20) in Snowflake CLI versions before 3.27.0 that permits SQL injection attacks. Unsanitized user-controlled values from project configuration files or command-line arguments are directly interpolated into SQL strings executed as multi-statement queries. Attack vectors include malicious project configuration files in repositories with CI/CD pipelines running Snowflake CLI under elevated service accounts, or untrusted input supplied to CLI-wrapping automation. Successful exploitation allows execution of arbitrary SQL in the context of the victim's Snowflake session and active role, with impact limited by the role's permissions. The patch is available in version 3.27.0, requiring manual user upgrade.
Affected products
- Snowflake Snowflake CLI prior to 3.27.0
Timeline
- 2026-09-17: disclosed
- 2026-09-09: patched: Version 3.27.0 released