# CVE-2026-15067: Snowflake Terraform Provider SQL and DDL injection

Source: https://junglewise.ai/threats/cve-2026-15067-snowflake-terraform-provider-sql-and-ddl-injection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-08  
License: CC BY 4.0 with a link back

CVE-2026-15067 · Severity: high · CVSS 8.8 · Published 2026-07-08

The Snowflake Terraform Provider, used to automate the management of Snowflake data warehouse resources, contains vulnerabilities that could allow an attacker to execute unauthorized database commands. By manipulating variables within a deployment pipeline, an attacker could potentially steal sensitive data, create new administrative credentials, or bypass security controls. This could lead to a full compromise of the Snowflake environment managed by the affected Terraform configurations.

Vendors: [Snowflake](https://junglewise.ai/threats/vendors/snowflake).

## Quick answers

**Is CVE-2026-15067 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-15067 being exploited in the wild.

**How severe is CVE-2026-15067?** High severity, with a CVSS score of 8.8, published 8 July 2026.

**Which products and versions are affected?** Snowflake Terraform Provider 0.1.0 to 2.17.0.

**Is there a fix for CVE-2026-15067?** A patch was published on 2026-07-07: Version 2.18.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-15067 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-15067?** Check whether you run Snowflake Terraform Provider at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The Snowflake Terraform Provider (versions < 2.18.0) suffers from multiple injection vulnerabilities due to improper neutralization of user-supplied identifiers and data source inputs. Specifically, unsanitized data source inputs allow for SQL injection, enabling arbitrary SQL execution within the provider's privileged session. This can be exploited if an attacker can influence workspace variables in a pipeline where the data source is active. Additionally, improper neutralization in user resource inputs allows for DDL injection, which can be used to create user accounts with attacker-controlled credentials, bypassing intended security configurations. The vulnerabilities are addressed in version 2.18.0 through improved identifier quoting and single-quote escaping.

## Affected products

- Snowflake Terraform Provider for Snowflake 0.1.0 to 2.17.0

## Timeline

- 2026-07-07: patched: Version 2.18.0 released
- 2026-07-08: disclosed: CVE-2026-15067 published

## References

- [https://github.com/snowflakedb/terraform-provider-snowflake/releases](https://github.com/snowflakedb/terraform-provider-snowflake/releases)