PatchTheCVEsnowflake vulnerabilities
Recent CVEs affecting snowflake products. 7 tracked.
snowflake has 7 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 7. Most recent: 2026-06-29. Highest priority: CVE-2026-13749 (score 42/100).
- CVE-2026-13749 HIGH 8.8 UPGRADE Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior
- CVE-2026-13744 HIGH 8.3 UPGRADE Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed uninten
- CVE-2026-13752 MEDIUM 6.0 UPGRADE Improper neutralization of parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution
- CVE-2026-13748 MEDIUM 6.3 UPGRADE Improper restriction of file path resolution in Snowflake CLI versions prior to 3.19 allowed arbitrary local f
- CVE-2026-13750 MEDIUM 5.5 UPGRADE Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext cr
- CVE-2026-13751 MEDIUM 4.1 UPGRADE Improper handling of untrusted remote references in Snowflake CLI versions prior to 3.19 allowed server-side r
- CVE-2026-13746 LOW 3.6 UPGRADE Improper neutralization of local CLI parameters in Snowflake CLI versions prior to 3.19 allowed unintended SQL
FAQ
How do I fix snowflake vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is snowflake being exploited right now?
None of the tracked snowflake CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which snowflake CVE should I patch first?
CVE-2026-13749 currently ranks highest (42/100): Improper neutralization in the Snowpark annotation processor callback template in Snowflake CLI versions prior.