# CVE-2026-92903: Snowflake CLI SQL injection via improper input validation

Source: https://junglewise.ai/threats/cve-2026-92903-snowflake-cli-sql-injection-via-improper-input-validation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92903 · Severity: high · CVSS 8.2 · Published 2026-09-17

Snowflake CLI is a command-line tool used by developers and DevOps teams to manage Snowflake database resources. Versions prior to 3.27.0 fail to properly validate user-supplied input before inserting it into SQL queries, allowing attackers with repository write access or the ability to control CLI input to execute arbitrary SQL statements with the privileges of the configured Snowflake service account role. This could lead to unauthorized data access, modification, or deletion depending on the role's permissions.

Technologies: [Snowflake CLI](https://junglewise.ai/threats/technologies/snowflake-cli). Vendors: [Snowflake](https://junglewise.ai/threats/vendors/snowflake).

## Quick answers

**Is CVE-2026-92903 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92903 being exploited in the wild.

**How severe is CVE-2026-92903?** High severity, with a CVSS score of 8.2, published 17 September 2026.

**Which products and versions are affected?** Snowflake CLI prior to 3.27.0.

**Is there a fix for CVE-2026-92903?** A patch was published on 2026-09-09: Version 3.27.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-92903 attacked?** It is attacked over the network or with local access, in a software library.

**Am I affected by CVE-2026-92903?** Check whether you run Snowflake CLI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an improper input validation flaw (CWE-20) in Snowflake CLI versions before 3.27.0 that permits SQL injection attacks. Unsanitized user-controlled values from project configuration files or command-line arguments are directly interpolated into SQL strings executed as multi-statement queries. Attack vectors include malicious project configuration files in repositories with CI/CD pipelines running Snowflake CLI under elevated service accounts, or untrusted input supplied to CLI-wrapping automation. Successful exploitation allows execution of arbitrary SQL in the context of the victim's Snowflake session and active role, with impact limited by the role's permissions. The patch is available in version 3.27.0, requiring manual user upgrade.

## Affected products

- Snowflake Snowflake CLI prior to 3.27.0

## Timeline

- 2026-09-17: disclosed
- 2026-09-09: patched: Version 3.27.0 released

## References

- [https://pypi.org/](https://pypi.org/)
- [https://github.com/snowflakedb/snowflake-cli/releases/tag/v3.27.0](https://github.com/snowflakedb/snowflake-cli/releases/tag/v3.27.0)

## Related threats

- [Snowflake CLI SQL injection in command parameters](https://junglewise.ai/threats/cve-2026-13752-snowflake-cli-sql-injection-in-command-parameters)
- [Snowflake CLI SSRF and Remote SQL Execution in SQL Reader](https://junglewise.ai/threats/cve-2026-13751-snowflake-cli-ssrf-and-remote-sql-execution-in-sql-reader)
- [Snowflake CLI sensitive information disclosure in local logs](https://junglewise.ai/threats/cve-2026-13750-snowflake-cli-sensitive-information-disclosure-in-local-logs)
- [Snowflake CLI path traversal in project file processing](https://junglewise.ai/threats/cve-2026-13748-snowflake-cli-path-traversal-in-project-file-processing)
- [Snowflake CLI SQL injection in local CLI parameters](https://junglewise.ai/threats/cve-2026-13746-snowflake-cli-sql-injection-in-local-cli-parameters)