What is the CVSS score of CVE-2026-13750?

CVE-2026-13750 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-13750?

Yes, a patch is available for CVE-2026-13750. Update the affected software to the latest version immediately.

Snowflake CLI CVE-2026-13750

EUVD-2026-40137 MEDIUM

Insertion of Sensitive Information into Log File (CWE-532)

2026-06-29 SNOWFLAKE

GHSA-hrp8-4956-5gr5

Information Disclosure Snowflake Cli

5.5

CVSS 3.1 · Vendor: SNOWFLAKE

Severity by source

Vendor (SNOWFLAKE) PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

5.5 MEDIUM

Local filesystem read access and a low-privileged account are required; only confidentiality is impacted as credentials are exposed but no data is modified or made unavailable.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (SNOWFLAKE).

CVSS VectorVendor: SNOWFLAKE

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Patch available

Jun 29, 2026 - 18:01 EUVD

Analysis Generated

Jun 29, 2026 - 16:35 vuln.today

DescriptionCVE.org

Insertion of sensitive information into log files in Snowflake CLI versions prior to 3.19 allowed plaintext credentials to be written to persistent local debug logs. An attacker could exploit this by obtaining read access to the affected user's local log files, causing credentials such as passwords, tokens, or private key material to be exposed without additional application-level safeguards. Successful exploitation requires credentials to be present in the affected connection context and the resulting logs to be accessible from the local environment. The fix is available in Snowflake CLI version 3.19, and users must manually upgrade.

AnalysisAI

Snowflake CLI versions prior to 3.19 write plaintext credentials - including passwords, authentication tokens, and private key material - to persistent local debug log files due to CWE-532 (Insertion of Sensitive Information into Log File). Any local user account with read access to the affected user's log directory can harvest these credentials without needing application-level privileges. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the confidentiality impact is rated high given that full credential material may be exposed.

Technical ContextAI

Snowflake CLI (CPE: cpe:2.3:a:snowflake:snowflake_cli:*:*:*:*:*:*:*:*) is a command-line interface for interacting with the Snowflake cloud data platform. It maintains persistent debug log files on the local filesystem. The root cause is CWE-532: the CLI does not sanitize or redact credential values from connection context objects before writing diagnostic data to these logs. Affected credential types include passwords, OAuth or session tokens, and private key material used for key-pair authentication - all of which may be present depending on the configured connection profile. Because log files are written to disk and persist across sessions, the exposure window extends beyond the CLI's runtime.

RemediationAI

Upgrade Snowflake CLI to version 3.19 or later; this is a manual upgrade and does not occur automatically. Per the description, version 3.19 is the vendor-released patch. Following upgrade, existing log files from prior versions should be located and deleted or securely wiped, as they may already contain plaintext credentials. On Linux/macOS, Snowflake CLI logs are typically found in ~/.snowflake/ or a platform-specific cache/log directory - users should audit these paths. If immediate upgrade is not possible, disable or reduce debug logging verbosity in the CLI configuration to limit credential capture; however, the exact configuration flag depends on CLI version and should be verified against Snowflake documentation. Additionally, rotate any credentials (passwords, tokens, private keys) that may have been logged, particularly in shared or multi-user environments. In CI/CD pipelines, ensure log artifact retention policies exclude Snowflake CLI debug output. The full advisory is at https://community.snowflake.com/s/article/Snowflake-CLI-Vulnerability-Advisory.