# Snowflake CLI vulnerabilities Source: https://junglewise.ai/threats/technologies/snowflake-cli Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/snowflake-cli.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 8 vulnerabilities in Snowflake CLI: 0 in the last 7 days and 1 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-92903, was published on 17 September 2026. Nothing in the last four weeks, down from 1 vulnerability in the four before. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 1 - All time: 8 (0 critical, 0 exploited in the wild) ## About Snowflake CLI A command-line interface for connecting to Snowflake to execute SQL queries and perform database administration and data loading tasks. ## Latest Snowflake CLI vulnerabilities - [CVE-2026-92903: Snowflake CLI SQL injection via improper input validation](https://junglewise.ai/threats/cve-2026-92903-snowflake-cli-sql-injection-via-improper-input-validation) (high, CVSS 8.2, published 17 Sep 2026) - [CVE-2026-13752: Snowflake CLI SQL injection in command parameters](https://junglewise.ai/threats/cve-2026-13752-snowflake-cli-sql-injection-in-command-parameters) (medium, CVSS 6, published 29 Jun 2026) - [CVE-2026-13751: Snowflake CLI SSRF and Remote SQL Execution in SQL Reader](https://junglewise.ai/threats/cve-2026-13751-snowflake-cli-ssrf-and-remote-sql-execution-in-sql-reader) (medium, CVSS 4.1, published 29 Jun 2026) - [CVE-2026-13750: Snowflake CLI sensitive information disclosure in local logs](https://junglewise.ai/threats/cve-2026-13750-snowflake-cli-sensitive-information-disclosure-in-local-logs) (medium, CVSS 5.5, published 29 Jun 2026) - [CVE-2026-13749: Snowflake Snowflake CLI code injection in Snowpark annotation processor](https://junglewise.ai/threats/cve-2026-13749-snowflake-snowflake-cli-code-injection-in-snowpark-annotation) (high, CVSS 8.8, published 29 Jun 2026) - [CVE-2026-13748: Snowflake CLI path traversal in project file processing](https://junglewise.ai/threats/cve-2026-13748-snowflake-cli-path-traversal-in-project-file-processing) (medium, CVSS 6.3, published 29 Jun 2026) - [CVE-2026-13746: Snowflake CLI SQL injection in local CLI parameters](https://junglewise.ai/threats/cve-2026-13746-snowflake-cli-sql-injection-in-local-cli-parameters) (low, CVSS 3.6, published 29 Jun 2026) - [CVE-2026-13744: Snowflake Snowflake CLI SQL injection in project configuration](https://junglewise.ai/threats/cve-2026-13744-snowflake-snowflake-cli-sql-injection-in-project-configuration) (high, CVSS 8.3, published 29 Jun 2026) ## Most severe Snowflake CLI vulnerabilities - [CVE-2026-13749: Snowflake Snowflake CLI code injection in Snowpark annotation processor](https://junglewise.ai/threats/cve-2026-13749-snowflake-snowflake-cli-code-injection-in-snowpark-annotation) (high, CVSS 8.8, published 29 Jun 2026) - [CVE-2026-13744: Snowflake Snowflake CLI SQL injection in project configuration](https://junglewise.ai/threats/cve-2026-13744-snowflake-snowflake-cli-sql-injection-in-project-configuration) (high, CVSS 8.3, published 29 Jun 2026) - [CVE-2026-92903: Snowflake CLI SQL injection via improper input validation](https://junglewise.ai/threats/cve-2026-92903-snowflake-cli-sql-injection-via-improper-input-validation) (high, CVSS 8.2, published 17 Sep 2026) - [CVE-2026-13748: Snowflake CLI path traversal in project file processing](https://junglewise.ai/threats/cve-2026-13748-snowflake-cli-path-traversal-in-project-file-processing) (medium, CVSS 6.3, published 29 Jun 2026) - [CVE-2026-13752: Snowflake CLI SQL injection in command parameters](https://junglewise.ai/threats/cve-2026-13752-snowflake-cli-sql-injection-in-command-parameters) (medium, CVSS 6, published 29 Jun 2026) - [CVE-2026-13750: Snowflake CLI sensitive information disclosure in local logs](https://junglewise.ai/threats/cve-2026-13750-snowflake-cli-sensitive-information-disclosure-in-local-logs) (medium, CVSS 5.5, published 29 Jun 2026) - [CVE-2026-13751: Snowflake CLI SSRF and Remote SQL Execution in SQL Reader](https://junglewise.ai/threats/cve-2026-13751-snowflake-cli-ssrf-and-remote-sql-execution-in-sql-reader) (medium, CVSS 4.1, published 29 Jun 2026) - [CVE-2026-13746: Snowflake CLI SQL injection in local CLI parameters](https://junglewise.ai/threats/cve-2026-13746-snowflake-cli-sql-injection-in-local-cli-parameters) (low, CVSS 3.6, published 29 Jun 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 1 vulnerability in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 1 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Snowflake technologies - [Snowflake Connector for Python](https://junglewise.ai/threats/technologies/connector-for-python): 6 vulnerabilities - [Snowflake PHP PDO Driver](https://junglewise.ai/threats/technologies/php-pdo-driver): 4 vulnerabilities - [Snowflake Libsnowflakeclient](https://junglewise.ai/threats/technologies/libsnowflakeclient): 3 vulnerabilities - [Snowflake ODBC Driver](https://junglewise.ai/threats/technologies/odbc-driver): 3 vulnerabilities - [Snowflake Go Driver](https://junglewise.ai/threats/technologies/snowflake-go-driver): 3 vulnerabilities - [Snowflake JDBC Driver](https://junglewise.ai/threats/technologies/snowflake-jdbc-driver): 3 vulnerabilities - [Snowflake Node.js Driver](https://junglewise.ai/threats/technologies/snowflake-node-js-driver): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Snowflake CLI vulnerabilities", https://junglewise.ai/threats/technologies/snowflake-cli, 9 November 2026.