Executive brief
The Snowflake Terraform Provider, used to automate the management of Snowflake data warehouse resources, contains vulnerabilities that could allow an attacker to execute unauthorized database commands. By manipulating variables within a deployment pipeline, an attacker could potentially steal sensitive data, create new administrative credentials, or bypass security controls. This could lead to a full compromise of the Snowflake environment managed by the affected Terraform configurations.
Technical details
The Snowflake Terraform Provider (versions < 2.18.0) suffers from multiple injection vulnerabilities due to improper neutralization of user-supplied identifiers and data source inputs. Specifically, unsanitized data source inputs allow for SQL injection, enabling arbitrary SQL execution within the provider's privileged session. This can be exploited if an attacker can influence workspace variables in a pipeline where the data source is active. Additionally, improper neutralization in user resource inputs allows for DDL injection, which can be used to create user accounts with attacker-controlled credentials, bypassing intended security configurations. The vulnerabilities are addressed in version 2.18.0 through improved identifier quoting and single-quote escaping.
Affected products
- Snowflake Terraform Provider for Snowflake 0.1.0 to 2.17.0
Timeline
- 2026-07-07: patched: Version 2.18.0 released
- 2026-07-08: disclosed: CVE-2026-15067 published