CVE-2026-13750: Snowflake CLI Sensitive Credential Exposure Through Debug Logging
Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Snowflake CLIto a version that resolves this vulnerability.Fixed in 3.19 - Operational
After upgrading Snowflake CLI to 3.19, review the persistent local debug log files for plaintext credentials (passwords, tokens, or private key material) and treat any exposed credentials as compromised.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13750?
The severity of CVE-2026-13750 is rated as medium with a score of 5.5.
How do I fix CVE-2026-13750?
To fix CVE-2026-13750, upgrade to Snowflake CLI version 3.19 or later where this vulnerability is resolved.
What does CVE-2026-13750 expose?
CVE-2026-13750 exposes sensitive credentials through debug logging in Snowflake CLI versions prior to 3.19.
Who can exploit CVE-2026-13750?
An attacker with read access to the affected user's local log files can exploit CVE-2026-13750.
What types of credentials are affected by CVE-2026-13750?
CVEs-2026-13750 affects plaintext credentials such as passwords written to persistent local debug logs.