CVE-2026-13751

{"id": "CVE-2026-13751", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-13751", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-29T17:23:00.396853Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.1, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.0}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.6, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "412d305a-227d-44f9-a262-a31ba44f2aea", "affectedData": [{"vendor": "Snowflake", "product": "Snowflake CLI", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.19.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-29T17:16:30.050", "references": [{"url": "https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory", "tags": ["Vendor Advisory"], "source": "412d305a-227d-44f9-a262-a31ba44f2aea"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "412d305a-227d-44f9-a262-a31ba44f2aea", "description": [{"lang": "en", "value": "CWE-829"}, {"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side request forgery. The SQL statement reader's !source/!load directives could reference remote URLs that were retrieved at runtime without sufficient restriction on the request destination. By supplying crafted SQL content processed through a vulnerable command path, an attacker could cause the victim's environment to issue unintended outbound requests to internal or otherwise non-public network locations, and could cause remote SQL content to be retrieved and executed in the context of the victim user's session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges available to that session and environment. The fix is available in Snowflake CLI version 3.19, which adds an option to disable remote URL retrieval."}, {"lang": "es", "value": "El manejo inadecuado de referencias remotas no confiables en versiones de Snowflake CLI anteriores a la 3.19 permiti\u00f3 la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Las directivas !source/!load del lector de sentencias SQL pod\u00edan hacer referencia a URL remotas que se recuperaban en tiempo de ejecuci\u00f3n sin suficiente restricci\u00f3n en el destino de la petici\u00f3n. Al proporcionar contenido SQL manipulado procesado a trav\u00e9s de una ruta de comando vulnerable, un atacante pod\u00eda hacer que el entorno de la v\u00edctima emitiera peticiones salientes no intencionadas a ubicaciones de red internas o de otro modo no p\u00fablicas, y pod\u00eda hacer que se recuperara y ejecutara contenido SQL remoto en el contexto de la sesi\u00f3n del usuario v\u00edctima. La explotaci\u00f3n exitosa requiere que la v\u00edctima procese contenido controlado por el atacante a trav\u00e9s de una ruta de comando vulnerable y est\u00e1 limitada por los privilegios disponibles para esa sesi\u00f3n y entorno. La soluci\u00f3n est\u00e1 disponible en la versi\u00f3n 3.19 de Snowflake CLI, que a\u00f1ade una opci\u00f3n para deshabilitar la recuperaci\u00f3n de URL remotas."}], "lastModified": "2026-10-25T21:10:00.770", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BF808F4-F829-462E-9AE3-BF042545C017", "versionEndExcluding": "3.19.0", "versionStartIncluding": "1.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "412d305a-227d-44f9-a262-a31ba44f2aea"}