CVE ID
CVE-2026-15067
CVE ID Summary
SQL injection via an unsanitized data source input and DDL injection in user resource inputs could allow arbitrary SQL execution under the provider's privileged session and creation of accounts with attacker-controlled credentials.
CWE ID
CWE-89: Improper Neutralization of Special Elements used in an SQL Command
Affected Versions
0.1.0 to before 2.17.0
Patched Versions
2.18.0
Description
Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input that could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to influence a workspace variable in a pipeline where this data source was enabled. Improper neutralization of identifier content in user resource inputs could allow DDL injection into user management statements, potentially causing accounts to be created with attacker-controlled credentials and without the security controls configured by the operator. Snowflake fixed the issue in version 2.18.0.
Resolution
Upgrade to Terraform Provider for Snowflake version 2.18.0 or later. Users must manually upgrade.
