Read the docs
TI-2026-62576 Aliases CVE-2026-92903GHSA-p2xq-qfx5-xp6q

SQL injection in Snowflake CLI

Priority LOW 37CWE-89Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
Required
Attack complexity
Low
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Improper input validation in Snowflake CLI versions prior to 3.27.0 allowed unsanitized user-controlled values to be interpolated into SQL strings that are executed as multi-statement queries. An attacker who is able to supply a malicious project configuration file or craft command-line input can cause Snowflake CLI to execute attacker-controlled SQL statements in the context of the victim's Snowflake session and active role. Successful exploitation requires either write or pull-request access to a project repository whose CI/CD pipeline runs Snowflake CLI under an elevated service account role, or the ability to supply untrusted input to CLI-wrapping automation. Impact is limited by the privileges held by the configured Snowflake role at execution time. The fix is available in Snowflake CLI version 3.27.0, which also addresses several additional security findings. Users must manually upgrade.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00194 9th percentileScored 2026-11-07
Fix Fixed Snowflake CLI (Snowflake): 3.27.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
SnowflakeSnowflake CLIbefore 3.27.03.27.0Patch availableCNA
SnowflakeSnowflake CLIbefore 3.27.03.27.0Patch availableCNA
  • Snowflake CLI VendorSnowflake Affected before 3.27.0 Fixed in 3.27.0 Patch available CNA
  • Snowflake CLI VendorSnowflake Affected before 3.27.0 Fixed in 3.27.0 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*——Snowflake
  • cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:* Versions — — ·Snowflake

Remediation

  • Fix · CNA Snowflake CLI (Snowflake) Fixed in 3.27.0
  • Fix · CNA Snowflake CLI (Snowflake) Fixed in 3.27.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-92903
  2. 2026-10-03 Alias added: GHSA-p2xq-qfx5-xp6q

References

Other 1

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
  • TI-2026-13340 Improper TLS Hostname Verification in Snowflake Connector for Python CVSS 4.0CRITICAL 9.2
  • TI-2026-09272 Streamlit Palette hashing.py weak hash CVSS 4.0LOW 2.0
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences