CVE-2026-13751 is a medium severity flaw (CVSS 4.1) in Snowflake CLI before 3.19. The !source and !load directives in SQL content could fetch remote URLs, including internal ones, and run remote SQL in your session. Version 3.19 adds an option to disable remote URL retrieval.
What's affected
Per the record, Snowflake CLI versions prior to 3.19 are affected. The fix is Snowflake CLI 3.19, which adds an option to disable remote URL retrieval. The Snowflake advisory page needs JavaScript and did not load for our fetch, so read the Snowflake community article for the exact option name and setting.
The exposure needs a victim to process attacker controlled SQL content through a vulnerable command path, and it is limited by the privileges of that session.
How to check if you're exposed
Check the installed version:
snow --version
Then think about where your CLI runs and what SQL it reads. Risk is higher in CI jobs, shared notebooks and scripts that run SQL files from sources you do not control, such as downloaded scripts or content from pull requests.
If you manage many machines, search for installed copies in your package inventory. The CLI may be installed with pip, pipx, Homebrew or a system package, and each has its own upgrade command, so use the one that installed it.
In CI, look at jobs that run SQL files with the CLI. If any job runs a file that came from a pull request, a download or a third party, that is the input the advisory worries about. Check those files for the source and load directives.
What to do now
- Check the installed CLI version on laptops, CI runners and containers.
- Upgrade to 3.19 or later using the same tool you installed it with.
- Turn on the option that disables remote URL retrieval, as described in the advisory.
- Do not run SQL files from untrusted sources, and review files that use the source or load directives.
- Use least privilege roles for sessions that run scripts in CI.
- Pin the CLI version in CI so an upgrade is deliberate and easy to verify.
Why it matters
The SQL reader treats a source or load directive as an instruction to fetch another file. When that target can be a URL, the CLI becomes a client that fetches whatever it is told, from wherever it runs. That is server side request forgery in a client tool, so internal addresses are reachable from the victim machine.
The record also notes that fetched SQL is executed in the victim session, so impact follows the role in use. The score is medium because the vector is local, needs user interaction and has high complexity. The record does not flag this CVE as known exploited.
There is a general rule behind this. Any tool that follows a reference in a data file to fetch more content should either refuse remote targets by default or restrict where it may go. Treat SQL files from outside your team the way you treat scripts from outside your team.
The record lists these weakness classes: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), CWE-918 (Server-Side Request Forgery (SSRF)).
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need the new option if I upgrade?
The advisory says 3.19 adds an option to disable remote URL retrieval. Read the advisory for the default behaviour and set the option if you never need remote files.
Why is the severity only medium?
The vector is local, needs a victim to process attacker controlled content, and has high complexity. The impact is also limited by the privileges of the session.
What does the new option do?
The record says version 3.19 adds an option to disable remote URL retrieval. Read the Snowflake advisory for the option name before you set it.
Sources
Last reviewed: 19 October 2026.
