CVE-2026-15067: Critical SQL and DDL Injection in Snowflake Terraform Provider <2.18.0

Technical summary

CVE-2026-15067 encompasses SQL injection (CWE-89) in data source input handling and improper DDL neutralization in user resource inputs within the Snowflake Terraform Provider. The SQL injection arises from unsanitized data source parameters, allowing arbitrary query execution within the provider's authenticated Snowflake session context. The DDL injection occurs in user management statements due to insufficient identifier sanitization, enabling attackers to craft malicious user creation directives that persist with attacker-controlled credentials. Both vulnerabilities require authenticated access to influence Terraform workspace variables or pipeline inputs, limiting direct remote exploitation but raising insider threat and supply chain concerns.

Business impact

Exploitation enables lateral movement within Snowflake, unauthorized data access, and creation of backdoor accounts that persist after the initial compromise is discovered. An attacker could extract customer data, PII, or proprietary analytics without detection. The ability to create rogue admin-equivalent accounts means remediation requires comprehensive account audits and potential credential rotation across your data platform. If Terraform is used in multi-tenant or CI/CD contexts, a single compromised pipeline could affect multiple deployments simultaneously.

Affected systems

All organizations running Snowflake Terraform Provider versions prior to 2.18.0 are affected. This includes both direct Terraform users and those consuming this provider indirectly through Terraform modules or remote state backends. Environments where non-admin personnel can modify Terraform workspace variables or pipeline definitions carry elevated risk, as do CI/CD systems where untrusted code or dependencies can influence provider configuration.

Exploitability

Exploitation is not trivial—an attacker must first gain the ability to modify workspace variables or influence data source inputs within your Terraform pipeline. This typically requires compromised credentials, supply chain injection (via a malicious Terraform module or dependency), or insider access. Once that foothold exists, the injection attacks are straightforward to execute and difficult to detect in real-time. CVSS 8.8 (HIGH) reflects the high impact (data exfiltration, account takeover) balanced against the requirement for authenticated or pipeline-level access.

Remediation

Upgrade the Snowflake Terraform Provider to version 2.18.0 or later immediately. This is a manual process; the upgrade does not occur automatically. After upgrading, audit your Snowflake instance for any unexpected user accounts or access patterns that may indicate prior exploitation. Rotate service account credentials used by Terraform to access Snowflake, and review Terraform workspace variable history and pipeline logs for evidence of injection attempts. Implement strict access controls on who can modify workspace variables and pipeline definitions.

Patch guidance

Download and deploy Snowflake Terraform Provider version 2.18.0 or later from the official Terraform Registry or GitHub releases. Verify the release notes confirm the security fixes for SQL injection and DDL injection. Test the upgrade in a non-production environment first to ensure compatibility with your existing Terraform configurations. Update any CI/CD pipelines, Docker images, or Terraform modules that pin or reference the provider to the new version. Document the upgrade date and affected infrastructure for audit purposes.

Detection guidance

Monitor Snowflake audit logs for unusual SQL statements or user creation events, particularly those containing suspicious string concatenation or escaped quotes. In Terraform state files and logs, look for data source inputs that contain SQL keywords or special characters. Review workspace variable change history for modifications by unexpected users or service accounts. Search CI/CD logs for failed or suspicious Terraform plan/apply operations that reference user or data source resources. Set up alerts on Snowflake for rapid creation of new users or privilege grants, as these may indicate exploitation.

Why prioritize this

HIGH priority: SQL and DDL injection in your infrastructure-as-code tool can compromise your entire data platform. The persistence of injected user accounts makes post-compromise remediation expensive and time-consuming. While exploitation requires some form of access to Terraform, the consequences—full data platform compromise—justify immediate patching before expanding Terraform access or deploying new infrastructure dependent on this provider.

Risk score, explained

CVSS 8.8 reflects high confidentiality, integrity, and availability impact (C:H, I:H, A:H) achievable with low attack complexity (AC:L) and low privilege requirements (PR:L), but requiring network access (AV:N) and no user interaction (UI:N). The score appropriately captures the severity of SQL and DDL injection in a privileged cloud context, though real-world risk depends heavily on your controls around Terraform variable modification and pipeline security.

Frequently asked questions