The vulnerability arises from the Snowflake CLI writing plaintext sensitive credentials—such as passwords, tokens, or private key material—to persistent local debug logs in versions before 3.19. If an attacker can read those logs, the exposed information can be used to impersonate the user or gain unauthorized access to Snowflake resources. This is a classic information disclosure flaw (CWE‑532) that does not affect the CLI runtime itself but compromises credential confidentiality.

All Snowflake CLI environments running a version earlier than 3.19 are affected. The product is Snowflake CLI, version 3.18 and below.

The CVSS score of 5.5 places the vulnerability in the medium severity range. EPSS data is not provided, and the flaw is not listed in the CISA KEV catalog, suggesting a lower probability of active exploitation. However, the attack requires local read access to the user’s log files, so systems that expose these logs to potential adversaries or have weak file‑system permissions face a higher risk. Once the logs are accessed, credentials are exposed in plaintext without additional mitigation from the application.