CVE-2026-15067
Received Received - Intake

SQL Injection and DDL Injection in Snowflake Terraform Provider

Publication date: 2026-07-08

Last updated on: 2026-07-08

Assigner: 412d305a-227d-44f9-a262-a31ba44f2aea

Description
Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to influence a workspace variable in a pipeline where this data source was enabled. Improper neutralization of identifier content in user resource inputs could allow DDL injection into user management statements, potentially causing accounts to be created with attacker-controlled credentials and without the security controls configured by the operator. The fix is available in Snowflake Terraform Provider version 2.18.0. Users must manually upgrade.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-08
Last Modified
2026-07-08
Generated
2026-07-08
AI Q&A
2026-07-08
EPSS Evaluated
N/A
NVD
CVE-2026-15067
EUVD
EUVD-2026-42284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
snowflake terraform_provider to 2.18.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Compliance Impact

This vulnerability in the Snowflake Terraform Provider allows for arbitrary SQL execution and potential creation of accounts with attacker-controlled credentials, which could lead to sensitive data exfiltration and unauthorized access.

Such unauthorized access and data exfiltration risks could negatively impact compliance with data protection regulations like GDPR and HIPAA, which require strict controls over sensitive data and access management.

Therefore, exploitation of this vulnerability may result in violations of these standards due to compromised confidentiality, integrity, and availability of protected data.

Executive Summary

Snowflake Terraform Provider versions prior to 2.18.0 contain multiple security vulnerabilities. These include SQL injection through an unsanitized data source input, which could allow arbitrary SQL execution within the provider's privileged Snowflake session. This could lead to sensitive data being exfiltrated and the creation of long-lived access credentials. Additionally, improper neutralization of identifier content in user resource inputs could enable DDL injection in user management statements, potentially allowing attacker-controlled accounts to be created without the operator's configured security controls.

Impact Analysis

Exploitation of this vulnerability could result in unauthorized execution of SQL commands with high privileges, leading to sensitive data exposure and unauthorized creation of access credentials. Attackers could exfiltrate sensitive information and create accounts with attacker-controlled credentials that bypass security controls, potentially compromising the integrity and confidentiality of your Snowflake environment.

Mitigation Strategies

To mitigate this vulnerability, you should manually upgrade the Snowflake Terraform Provider to version 2.18.0 or later, where the security issues have been fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-15067. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart