CVE-2026-92903

Executive Summary

CVE-2026-92903 is a high-severity SQL injection vulnerability (CWE-89) in the Snowflake CLI, affecting all versions prior to 3.27.0. The flaw allows unsanitized user-controlled values to be interpolated into SQL strings executed as multi-statement queries, enabling an attacker to execute arbitrary SQL in the context of the victim's Snowflake session and active role. Organizations running Snowflake CLI in CI/CD pipelines under elevated service-account roles are at highest risk, with a CVSS score of 8.2 reflecting high confidentiality, integrity, and availability impact.

Technical Analysis

CVE-2026-92903 resides in the Snowflake CLI, a command-line interface tool used by developers, data engineers, and automation systems to interact with Snowflake data cloud environments. The vulnerability class is SQL Injection (CWE-89), specifically arising from improper input validation.

Mechanism: The root cause is that the CLI fails to sanitize user-controlled values before interpolating them into SQL query strings. Critically, these queries are executed as multi-statement queries, which significantly expands the attack surface. In a standard single-statement context, injection payloads are often constrained by the query parser; with multi-statement execution enabled, an attacker can append arbitrary SQL statements that execute sequentially in the same session context.

Attack Surface: The NVD description identifies two primary vectors for supplying malicious input:

1. Malicious project configuration files — A project configuration file consumed by the Snowflake CLI can contain attacker-controlled values that are interpolated into SQL strings. An attacker with write access to a project repository, or the ability to submit a pull request that is merged, can plant these values. When the CI/CD pipeline subsequently invokes Snowflake CLI, the injected SQL executes automatically.

2. Crafted command-line input — Values passed directly to the CLI as command-line arguments can be weaponized when the CLI interpolates them into multi-statement SQL queries without sanitization.

Execution Context: The injected SQL executes in the context of the victim's Snowflake session and the active role at the time of CLI invocation. This means the attacker does not need to authenticate to Snowflake independently — they inherit the session and privileges of the CLI invocation, which in CI/CD environments is frequently an elevated service-account role.

The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H) indicates: local attack vector, low attack complexity, low privileges required, user interaction required, scope changed (indicating the vulnerable component impacts resources beyond its security scope — consistent with SQL executing in a separate Snowflake environment), and high impact to confidentiality, integrity, and availability.

No patch evidence is available from any tracked source. The patch confidence is 0/4, indicating an unpatched status in tracked sources, though the NVD description states a fix is available in version 3.27.0.

Exploitation Scenarios

No public PoC is available. The attack chain below is inferred from the vulnerability class (multi-statement SQL injection via unsanitized input in a CLI tool) as described in the NVD entry.

Important: No specific function names, file paths, API endpoints, or parameter names are present in the available intelligence. The following describes the attack at the vulnerability-class level only.

1. Reconnaissance / Target Identification: The attacker identifies an organization using Snowflake CLI in automated workflows. This is achievable by examining public repositories for CI/CD configuration files that reference Snowflake CLI, observing package dependencies, or identifying projects where the attacker has contributor access. High-value targets are repositories whose CI/CD pipelines invoke Snowflake CLI under an elevated service-account role.

2. Triggering the Flaw Class: The attacker requires one of two access paths as stated in the NVD description: (a) write or pull-request access to a project repository, or (b) the ability to supply untrusted input to CLI-wrapping automation. In path (a), the attacker modifies a project configuration file to embed a crafted value that the CLI will interpolate into a SQL string. In path (b), the attacker supplies malicious command-line input to an automation wrapper that passes it to the CLI.

3. Payload / Execution at the Vulnerability-Class Level: Because the CLI builds multi-statement SQL by string interpolation without sanitization, a crafted value can terminate the intended statement and introduce additional attacker-controlled SQL statements. These appended statements execute sequentially within the same Snowflake session. The exact payload delimiter and syntax depend on the Snowflake SQL dialect and are not specified in the available intelligence.

4. Post-Exploitation Impact: The injected SQL executes with the privileges of the active Snowflake role. Effects could include unauthorized data retrieval (e.g., querying tables the session can access), data modification or deletion, schema alteration, and depending on role privileges, privilege escalation within Snowflake or lateral movement to other accessible objects. In CI/CD contexts running under an elevated service-account role, the blast radius can extend across all objects that role can reach.

The attack requires user interaction (UI:R) because a maintainer must merge a malicious pull request or an operator must invoke the CLI with untrusted input. Low privileges (PR:L) reflect that repository contributor-level access is sufficient on the supply-chain path.

Impact Assessment

Business Impact: Successful exploitation allows arbitrary SQL execution within the victim's Snowflake environment under the session's active role. Because Snowflake commonly stores business-critical analytical data, the confidentiality and integrity impact is high. Availability impact is high as well — injected statements could drop or truncate tables, though the specific statements are attacker-chosen.

Affected Systems: Any environment where Snowflake CLI versions prior to 3.27.0 are used — developer workstations, build agents, and CI/CD runners. The most critical exposure is CI/CD pipelines that execute Snowflake CLI under elevated service-account roles, because a single malicious commit or merged pull request can trigger automated execution with broad privileges.

Blast Radius / Scope Change: The CVSS scope is Changed (S:C), reflecting that the vulnerable CLI component impacts a separate security authority — the Snowflake session/role. The blast radius is bounded by the privileges of the configured Snowflake role at execution time, as explicitly noted in the NVD description. Organizations following least-privilege principles for CI/CD service accounts will see reduced impact; those using broad admin roles will experience maximal impact.

CVSS Subscore Interpretation:

• AV:L (Local) — attack is not directly over the network against the CLI itself; it requires local/supply-chain positioning.
• AC:L (Low) — no special conditions beyond the stated access paths.
• PR:L (Low) — contributor-level repository access suffices.
• UI:R (Required) — a human must merge the PR or invoke the CLI.
• S:C (Changed) — impacts the Snowflake environment beyond the CLI's own scope.
• C:H/I:H/A:H — total compromise of confidentiality, integrity, and availability within the reachable Snowflake role.

Exploitability Context: No public exploit code, no Nuclei template, and no CISA KEV listing as of this report. EPSS has not yet scored this CVE. The absence of a public PoC reduces immediate opportunistic risk but does not eliminate targeted supply-chain risk.

Detection Guidance

The following detection content addresses the vulnerability at the class level (SQL injection via CLI input/configuration and anomalous multi-statement SQL execution). Because no concrete payload strings are published, rules focus on behavioral anomalies and structural indicators.

Sigma Rule

title: Suspicious Multi-Statement SQL Generation by Snowflake CLI
id: 8f3c1a92-6b47-4d2e-9c81-2a5f7e0d4b31
status: experimental
description: Detects Snowflake CLI invocations or configuration processing that may indicate SQL injection via unsanitized input (CVE-2026-92903)
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-92903
author: valtersit.com
date: 2026/01/01
logsource:
  category: process_creation
  product: linux
detection:
  selection_cli:
    Image|endswith:
      - '/snow'
      - '/snowflake'
      - 'snow.exe'
  selection_suspicious_args:
    CommandLine|contains:
      - '; DROP'
      - '; DELETE'
      - '; UPDATE'
      - '; INSERT'
      - '; GRANT'
      - '-- '
      - 'UNION SELECT'
  condition: selection_cli and selection_suspicious_args
falsepositives:
  - Legitimate multi-statement scripts executed via CLI
level: high
tags:
  - attack.t1195.002
  - cve.2026.92903

YARA Rule

rule CVE_2026_92903_Snowflake_CLI_SQLi_Markers
{
    meta:
        description = "Detects SQL injection markers in Snowflake CLI project config files or captured CLI inputs related to CVE-2026-92903"
        author = "valtersit.com"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-92903"
        severity = "high"

    strings:
        $cli_ref1 = "snowflake" ascii nocase
        $cli_ref2 = "snow" ascii nocase
        $sqli1 = "; DROP " ascii nocase
        $sqli2 = "; DELETE " ascii nocase
        $sqli3 = "; UPDATE " ascii nocase
        $sqli4 = "UNION SELECT" ascii nocase
        $sqli5 = "GRANT " ascii nocase
        $multi1 = ";" ascii
        $multi2 = "--" ascii

    condition:
        (any of ($cli_ref*)) and
        (2 of ($sqli*) or (1 of ($sqli*) and all of ($multi*)))
}

Suricata IDS Rule

alert tcp any any -> any 443 (msg:"CVE-2026-92903 Snowflake CLI SQL Injection - Multi-Statement SQL in Query Payload"; flow:established,to_server; content:"snowflakecomputing.com"; http_header; content:"SELECT"; http_client_body; nocase; content:";"; http_client_body; content:"DROP|20|"; http_client_body; nocase; sid:202692903; rev:1; reference:cve,2026-92903; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-92903; classtype:web-application-attack; metadata:service http;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name : ("snow", "snow.exe", "snowflake") and
   process.args : ("*;*", "*UNION*", "*DROP*", "*GRANT*")]
  [network where destination.domain : "*snowflakecomputing.com" and
   network.protocol : "https"]

Splunk SPL Query

index=endpoint OR index=processes
| search (process_name="snow" OR process_name="snow.exe" OR process_name="snowflake")
| where match(process_command_line, "(?i)(;\s*(DROP|DELETE|UPDATE|INSERT|GRANT|ALTER))|(?i)UNION\s+SELECT|(?i)--\s")
| stats count min(_time) as first_seen max(_time) as last_seen values(process_command_line) as command_lines by host, user, process_name
| sort - count

Wazuh OSSEC Rule

<group name="snowflake_cli,cve_2026_92903,">
  <rule id="20262903" level="12">
    <if_sid>5925</if_sid>
    <field name="audit.command">snow|snow\.exe|snowflake</field>
    <regex>(?i)(;\s*(DROP|DELETE|UPDATE|INSERT|GRANT|ALTER)|UNION\s+SELECT|--\s)</regex>
    <description>CVE-2026-92903: Possible SQL injection via Snowflake CLI multi-statement input</description>
    <mitre>
      <id>T1195.002</id>
    </mitre>
    <group>attack,sql_injection,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 (UNPATCHED — No patch evidence from any tracked source). While the NVD description states a fix is available in Snowflake CLI 3.27.0, no patch evidence was confirmed by tracked sources, and no workarounds are documented.

1. Immediate Mitigations:

   • Restrict write and pull-request merge rights on repositories whose CI/CD pipelines invoke Snowflake CLI; require mandatory code review and branch protection to prevent malicious configuration injection.
   • Apply least-privilege principles to Snowflake service-account roles used by CI/CD. Narrow the role's permissions so that injected SQL can only reach a minimal object set.
   • Do not pass untrusted or externally-influenced input to Snowflake CLI invocations or CLI-wrapping automation. Validate and allowlist all dynamic arguments.
   • Monitor CLI invocations for multi-statement SQL patterns and anomalous command-line content (see Detection Guidance).

2. Patch / Upgrade Steps:

   • Upgrade Snowflake CLI to version 3.27.0 or later. The NVD entry explicitly notes that the fix is available in 3.27.0 and that users must manually upgrade — no automatic update mechanism is stated.
   • After upgrade, verify the installed version via the CLI's standard version reporting and confirm the affected version range (< 3.27.0) is no longer present in developer environments and CI/CD runners.
   • Because 3.27.0 also "addresses several additional security findings," treat the upgrade as a consolidated security release and apply it broadly.

3. Long-Term Hardening:

   • Adopt software composition analysis (SCA) to track Snowflake CLI versions across all environments and flag outdated CLI dependencies in CI/CD pipelines.
   • Enforce CI/CD pipeline execution only from protected branches with signed commits, reducing the supply-chain injection path described in the NVD entry.
   • Implement parameterized query enforcement reviews for any internal tooling that constructs SQL for Snowflake; avoid string interpolation of user-controlled values.
   • Continuously monitor Snowflake query audit logs for unexpected multi-statement execution patterns originating from automation service accounts.

References

1. NVD — CVE-2026-92903: https://nvd.nist.gov/vuln/detail/CVE-2026-92903
2. Snowflake CLI Release Notes / Security Advisory (version 3.27.0) — consult the official Snowflake documentation and release channel for the vendor advisory (not confirmed in tracked sources at time of writing).
3. CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): https://cwe.mitre.org/data/definitions/89.html
4. MITRE ATT&CK T1195.002 — Compromise Software Supply Chain: https://attack.mitre.org/techniques/T1195/002/
5. CISA KEV Catalog — CVE-2026-92903 NOT listed as of this report (no known exploited-in-the-wild status): https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Threat Actor / Exploit-in-the-Wild Note: No public PoC, no Nuclei template, no exploit code, and no CISA KEV listing are associated with CVE-2026-92903 at the time of this report. EPSS has not yet been scored by FIRST.org. No specific threat actor campaigns are attributed.