CVE-2026-13748

Executive Summary

CVE-2026-13748 is a path traversal vulnerability in the Snowflake CLI (Command Line Interface) affecting versions prior to 3.19. The flaw allows an attacker to craft malicious repository or project content that, when processed by a victim using the Snowflake CLI, can read arbitrary local files from the victim's filesystem and exfiltrate their contents to Snowflake services. This is a client-side attack that requires user interaction (processing attacker-controlled content). The vulnerability is rated as Medium severity (CVSS 6.3) due to the high confidentiality impact but low attack complexity and requirement for user interaction. No public exploit code or proof-of-concept is currently available.

Supply Chain & Package Security

This vulnerability is specific to the Snowflake CLI, a Python-based tool distributed via PyPI (snowflake-cli-labs). Organizations using this tool in CI/CD pipelines or developer workstations are at risk. The attack vector involves processing untrusted project files (e.g., from a compromised repository or a malicious pull request). This highlights the importance of supply chain security for development tools that handle local file operations.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
• Attack Vector (AV): Local (L) – The attacker must have access to the victim's system or be able to supply content that the victim processes locally.
• Attack Complexity (AC): Low (L) – No special conditions required beyond the victim processing the malicious content.
• Privileges Required (PR): None (N) – The attacker does not need any privileges on the victim's system.
• User Interaction (UI): Required (R) – The victim must actively process the attacker-controlled project content (e.g., run snow commands on a malicious repository).
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the victim's local system.
• Confidentiality (C): High (H) – Arbitrary local files can be read and exfiltrated.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. The requirement for user interaction reduces the likelihood of widespread exploitation, but the potential for sensitive data exfiltration (e.g., SSH keys, cloud credentials, source code) makes it a significant risk in targeted attacks.

Deep Dive & Mechanics

The vulnerability resides in how the Snowflake CLI resolves file paths when processing project content, specifically during deployment or SQL template processing. The CLI uses a function to resolve file paths relative to a project root, but it fails to properly sanitize or restrict path traversal sequences (e.g., ../). An attacker can craft a project file (e.g., a snowflake.yml or SQL template) that references files outside the intended project directory.

Attack Flow:

1. An attacker creates a malicious Snowflake project repository containing a crafted configuration file (e.g., snowflake.yml) or SQL template that includes path traversal sequences.
2. The attacker distributes this repository (e.g., via a public GitHub repo, a pull request, or a compromised package).
3. A victim clones or downloads the repository and runs a Snowflake CLI command (e.g., snow deploy or snow sql).
4. The CLI processes the malicious content, resolves the path traversal, and reads the targeted local file (e.g., /etc/passwd, ~/.ssh/id_rsa, or cloud provider credentials).
5. The file content is then embedded in SQL queries or uploaded to Snowflake stages, making it accessible to the attacker if they have access to the victim's Snowflake account (e.g., via query history or stage content).

Root Cause: The file path resolution function does not validate that the resolved path stays within the project root directory. It uses os.path.join or similar functions without checking for .. sequences.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable: No path traversal check
def resolve_file_path(project_root, relative_path):
    return os.path.join(project_root, relative_path)

Patched Code (Conceptual):

# Patched: Validate that the resolved path is within the project root
def resolve_file_path(project_root, relative_path):
    resolved = os.path.abspath(os.path.join(project_root, relative_path))
    if not resolved.startswith(os.path.abspath(project_root)):
        raise ValueError("Path traversal detected")
    return resolved

The fix in version 3.19 adds a check to ensure the resolved path is within the project root directory, preventing access to files outside the intended boundary.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Snowflake CLI version < 3.19 installed on the victim's machine.
• Victim must process attacker-controlled project content.

Lab Setup:

1. Create a malicious Snowflake project:

   mkdir malicious_project
   cd malicious_project
   

2. Create a snowflake.yml file with a path traversal payload:

   # snowflake.yml
   project_name: malicious_project
   stages:
     - name: exfil_stage
       file_format: csv
       files:
         - path: "../../../../etc/passwd"
   

3. Alternatively, craft a SQL template that reads a local file:

   -- template.sql
   SELECT * FROM @exfil_stage;
   

4. Distribute the project (e.g., via a public GitHub repo or a pull request).

5. When the victim runs:

   snow deploy
   

   The CLI will read /etc/passwd and upload it to the Snowflake stage.

Exfiltration: The attacker can then query the stage or view query history in the victim's Snowflake account to retrieve the file contents.

Blue Team

Detection:

• Monitor Snowflake CLI process behavior for unexpected file reads (e.g., reading /etc/passwd, ~/.ssh/).
• Audit Snowflake query history for SQL queries containing file contents (e.g., base64-encoded data).
• Review Snowflake stage content for unexpected files.

Prevention:

• Enforce the use of Snowflake CLI version 3.19 or later.
• Implement file integrity monitoring on developer workstations.
• Use endpoint detection and response (EDR) tools to detect path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths: Unexpected reads of sensitive files (e.g., /etc/passwd, /etc/shadow, ~/.ssh/id_rsa, ~/.aws/credentials).
• Snowflake Query History: SQL queries containing file contents (e.g., SELECT 'root:x:0:0:root:/root:/bin/bash').
• Snowflake Stage Content: Files with names like passwd or credentials in unexpected stages.
• Process Anomalies: snow process reading files outside the project directory (detectable via Sysmon or auditd).

Detection Engineering

YARA Rule

rule CVE_2026_13748_Snowflake_CLI_Path_Traversal {
    meta:
        description = "Detects path traversal attempts in Snowflake CLI project files"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-13748"
    strings:
        $path_traversal = /\.\.\/[^"]+/ 
        $snowflake_yml = "snowflake.yml"
        $sql_template = ".sql"
    condition:
        ($path_traversal and ($snowflake_yml or $sql_template))
}

Sigma Rule

title: Snowflake CLI Path Traversal Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit CVE-2026-13748 by reading files outside the project directory
author: Valters IT
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\snow.exe'
        CommandLine|contains: '..\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in project files (unlikely)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2026-13748 Snowflake CLI Path Traversal Exfiltration";
    flow:to_server,established;
    content:"snowflake"; http_host;
    content:"PUT"; http_method;
    content:"stage"; http_uri;
    pcre:"/\.\.\//";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snowflake CLI: Update to version 3.19 or later.

   pip install --upgrade snowflake-cli-labs
   

2. Review Snowflake Account: Check query history and stage content for signs of exfiltration.
3. Rotate Credentials: If sensitive files (e.g., SSH keys, cloud credentials) were potentially exposed, rotate them immediately.

Long-term Mitigations:

• Implement code review processes for all project files before processing them with Snowflake CLI.
• Use sandboxed environments (e.g., containers) for running CLI commands on untrusted projects.
• Enable Snowflake audit logging and monitor for anomalous file uploads.

Valters IT