CVE-2026-13744

High

Published: 29 June 2026

Published

29 June 2026

Modified

30 June 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.3 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

EPSS Score 0.0032 23.8th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-13744 is a high-severity SQL Injection (CWE-89) vulnerability in Snowflake Snowflake Cli. Its CVSS base score is 8.3 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Cloud API (T1059.009); ranked at the 23.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-40129

Vulnerability details

Improper neutralization of attacker-controlled content in Snowflake CLI versions prior to 3.19 allowed unintended SQL execution. By supplying crafted repository content, project configuration, manifest data, or specification input, an attacker could cause Snowflake CLI to execute unintended SQL in the…

context of the victim user's Snowflake session. Successful exploitation requires the victim to process attacker-controlled content through a vulnerable command path and is limited by the privileges assigned to that session. The fix is available in Snowflake CLI version 3.19. Users must manually upgrade.

CWE(s): CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.009 Cloud API Execution

Adversaries may abuse cloud APIs to execute malicious commands.

attack.mitre.org →

T1213.006 Databases Collection

Adversaries may leverage databases to mine valuable information.

attack.mitre.org →

Why these techniques?

SQL injection (CWE-89) in Snowflake CLI directly enables arbitrary SQL command execution via Cloud API and database repository access in victim session.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0