CVE-2026-15067: Snowflake Terraform Provider SQLi Flaw

CVE-2026-15067 Overview

CVE-2026-15067 affects Snowflake Terraform Provider versions prior to 2.18.0. The provider contains multiple injection vulnerabilities, including SQL injection through an unsanitized data source input and DDL injection via improper neutralization of identifier content in user resource inputs. An attacker who can influence a workspace variable in a pipeline where the vulnerable data source is enabled can execute arbitrary SQL under the provider's privileged Snowflake session. The DDL injection path allows accounts to be created with attacker-controlled credentials, bypassing security controls configured by the operator. Snowflake fixed the vulnerabilities in Snowflake Terraform Provider 2.18.0, and users must manually upgrade.

Critical Impact
Arbitrary SQL execution under a privileged Snowflake session enables sensitive data exfiltration, minting of long-lived access credentials, and creation of attacker-controlled user accounts.

Affected Products

Snowflake Terraform Provider versions prior to 2.18.0
Terraform pipelines using the vulnerable Snowflake data source
Snowflake user resource configurations processed by affected provider versions

Discovery Timeline

2026-07-08 - CVE-2026-15067 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-15067

Vulnerability Analysis

The Snowflake Terraform Provider contains two related injection weaknesses classified under [CWE-89] (Improper Neutralization of Special Elements used in an SQL Command). The provider constructs Snowflake SQL and Data Definition Language (DDL) statements by concatenating user-controlled inputs into query strings without proper sanitization or parameterization. Because Terraform providers execute using privileged Snowflake credentials configured by the operator, injected statements run with the full authority of that session.

The first flaw resides in a data source that reads unsanitized input. When a workspace variable in a Terraform pipeline is attacker-influenced, the injected content becomes part of the executed SQL. This allows arbitrary query execution, including SELECT against sensitive tables and creation of long-lived programmatic access tokens.

The second flaw affects user resource inputs. Identifier fields are not properly neutralized before being interpolated into CREATE USER and related DDL statements. An attacker who controls those identifier values can append additional clauses that override operator-defined security controls such as password policies, network policies, and multi-factor authentication requirements.

Root Cause

The root cause is string concatenation of untrusted input into SQL and DDL statements without using bound parameters or strict identifier quoting. Snowflake identifiers require context-aware escaping, and the provider omitted that neutralization for specific resource and data source fields.

Attack Vector

Exploitation requires the ability to influence a workspace variable feeding a pipeline that consumes the vulnerable data source, or to control identifier content passed to the user resource. The attack is network-reachable through the Terraform pipeline execution context and requires low privileges as reflected in the CVSS vector. See the Snowflake Terraform Provider Releases for fix details.

Detection Methods for CVE-2026-15067

Indicators of Compromise

Unexpected CREATE USER, ALTER USER, or token-generation statements in Snowflake QUERY_HISTORY originating from the Terraform provider session
New Snowflake users, roles, or personal access tokens created outside of change-management windows
Terraform plan or apply logs referencing workspace variables with SQL metacharacters such as quotes, semicolons, or comment sequences

Detection Strategies

Query Snowflake ACCOUNT_USAGE.QUERY_HISTORY for statements executed by the Terraform service account that do not match expected resource templates
Compare Terraform state against actual Snowflake account state to identify drift indicating out-of-band DDL execution
Alert on any user creation that lacks the network policy or MFA attributes required by organizational baselines

Monitoring Recommendations

Forward Snowflake audit logs and Terraform Cloud or Enterprise run logs to a centralized data lake for correlation
Monitor changes to workspace variables and pipeline definitions in the CI/CD system that hosts Terraform runs
Track issuance of long-lived credentials and programmatic access tokens tied to the provider's Snowflake role

How to Mitigate CVE-2026-15067

Immediate Actions Required

Upgrade the Snowflake Terraform Provider to version 2.18.0 or later across all workspaces
Rotate Snowflake credentials, key pairs, and personal access tokens used by the provider role
Audit Snowflake user, role, and token inventory for unauthorized objects created since the vulnerable provider was in use

Patch Information

The fix is available in Snowflake Terraform Provider version 2.18.0. Users must manually upgrade the provider version pinned in their Terraform configurations, as the update is not applied automatically. Release notes are published at the Snowflake Terraform Provider Releases page.

Workarounds

Restrict who can modify workspace variables and pipeline inputs that flow into Snowflake data sources
Reduce the privileges of the Snowflake role used by the Terraform provider to the minimum required for managed resources
Disable or remove the vulnerable data source from Terraform configurations until the upgrade is completed

bash

# Pin the fixed provider version in Terraform configuration
terraform {
  required_providers {
    snowflake = {
      source  = "snowflakedb/snowflake"
      version = ">= 2.18.0"
    }
  }
}