CVE-2026-15067

Executive Summary

CVE-2026-15067 is a critical vulnerability (CVSS 8.8) in the Snowflake Terraform Provider affecting versions prior to 2.18.0. The vulnerability encompasses two primary attack vectors: SQL injection via unsanitized data source inputs, and DDL injection via improper neutralization of identifier content in user resource inputs. Successful exploitation allows an attacker with the ability to influence a workspace variable in a pipeline to execute arbitrary SQL under the provider's privileged Snowflake session, leading to sensitive data exfiltration and the minting of long-lived access credentials. The DDL injection vector enables the creation of accounts with attacker-controlled credentials, bypassing operator-configured security controls. This vulnerability is particularly dangerous in CI/CD pipelines where Terraform is used to manage Snowflake infrastructure, as it can lead to complete compromise of the Snowflake environment.

Supply Chain & Package Security

This vulnerability affects the Snowflake Terraform Provider, which is distributed via the Terraform Registry and HashiCorp's official channels. Organizations using Infrastructure as Code (IaC) pipelines that incorporate this provider are at risk. The supply chain risk is elevated because the provider runs with elevated privileges to manage Snowflake resources, and a compromised pipeline variable can lead to full database compromise. Users must manually upgrade to version 2.18.0, as there is no automatic patch mechanism.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - The attacker needs the ability to influence a workspace variable in a pipeline.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect resources beyond the Snowflake provider's scope.
• Confidentiality Impact (C): High (H) - Sensitive data can be exfiltrated.
• Integrity Impact (I): High (H) - Attacker-controlled accounts can be created.
• Availability Impact (A): High (H) - The vulnerability could lead to resource exhaustion or deletion.

Threat Level: Critical. The combination of low attack complexity, network exploitability, and high impact makes this a high-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability stems from two distinct but related issues in the Snowflake Terraform Provider:

1. SQL Injection via Data Source Input: The provider's data sources, which are used to query Snowflake for existing resources, do not properly sanitize user-supplied input. An attacker who can influence a workspace variable (e.g., via a compromised CI/CD pipeline or a malicious pull request) can inject arbitrary SQL into the query executed by the provider. Because the provider runs with a privileged Snowflake session, this SQL injection can be used to:

   • Exfiltrate sensitive data from any table or view.
   • Create or modify users and roles.
   • Mint long-lived access tokens or keys.
   • Execute ALTER ACCOUNT statements to change security settings.

2. DDL Injection via User Resource Inputs: The provider's snowflake_user resource does not properly neutralize identifier content. An attacker can inject DDL statements (e.g., CREATE USER, ALTER USER) into the username or other identifier fields. This allows the attacker to create accounts with attacker-controlled passwords and without the security controls (e.g., MFA, password policy) configured by the operator.

The attack flow typically involves:

1. Attacker gains the ability to modify a Terraform workspace variable (e.g., via a compromised CI/CD token or a malicious PR).
2. Attacker sets the variable to a malicious value containing SQL or DDL injection payloads.
3. The Terraform plan/apply operation triggers the vulnerable data source or resource.
4. The provider executes the injected SQL or DDL under its privileged session.
5. Attacker exfiltrates data or creates backdoor accounts.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.18.0):

// Vulnerable data source implementation
func dataSourceSnowflakeDatabase(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
    client := meta.(*sql.DB)
    databaseName := d.Get("name").(string)
    
    // UNSAFE: Direct string concatenation
    query := fmt.Sprintf("SHOW DATABASES LIKE '%s'", databaseName)
    rows, err := client.QueryContext(ctx, query)
    // ...
}

Patched Code (2.18.0):

// Patched data source implementation
func dataSourceSnowflakeDatabase(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
    client := meta.(*sql.DB)
    databaseName := d.Get("name").(string)
    
    // SAFE: Using parameterized query
    query := "SHOW DATABASES LIKE ?"
    rows, err := client.QueryContext(ctx, query, databaseName)
    // ...
}

Vulnerable Code for User Resource:

// Vulnerable user resource implementation
func resourceSnowflakeUserCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
    client := meta.(*sql.DB)
    userName := d.Get("name").(string)
    password := d.Get("password").(string)
    
    // UNSAFE: Direct string concatenation
    query := fmt.Sprintf("CREATE USER %s PASSWORD = '%s'", userName, password)
    _, err := client.ExecContext(ctx, query)
    // ...
}

Patched Code for User Resource:

// Patched user resource implementation
func resourceSnowflakeUserCreate(ctx context.Context, d *schema.ResourceData, meta interface{}) diag.Diagnostics {
    client := meta.(*sql.DB)
    userName := d.Get("name").(string)
    password := d.Get("password").(string)
    
    // SAFE: Using identifier quoting and parameterized query
    query := "CREATE USER IDENTIFIER(?) PASSWORD = ?"
    _, err := client.ExecContext(ctx, query, userName, password)
    // ...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a CI/CD pipeline that uses the Snowflake Terraform Provider (pre-2.18.0).
• Ability to modify a Terraform workspace variable (e.g., var.database_name).

Exploitation Steps:

1. Identify the vulnerable variable: Look for Terraform configurations that use data sources like snowflake_database, snowflake_schema, or snowflake_warehouse with user-supplied names.

2. Craft the injection payload: For SQL injection, use a payload like:

   '; SELECT GET_DDL('account', current_account()); --
   

   For DDL injection, use a payload like:

   malicious_user PASSWORD = 'attacker_password123' MUST_CHANGE_PASSWORD = FALSE
   

3. Modify the workspace variable: In the CI/CD pipeline, set the vulnerable variable to the crafted payload.

4. Trigger the pipeline: Run the Terraform plan or apply operation.

5. Exfiltrate data: Use the SQL injection to query sensitive tables (e.g., SNOWFLAKE.ACCOUNT_USAGE.USERS, SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY).

6. Create backdoor accounts: Use the DDL injection to create a user with known credentials:

   attacker_user PASSWORD = 'P@ssw0rd!' DEFAULT_ROLE = ACCOUNTADMIN
   

Example Payload for Data Exfiltration:

'; COPY INTO @my_stage/exfiltrated_data.csv FROM (SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.USERS) FILE_FORMAT = (TYPE = CSV); --

Blue Team

Detection and Response:

1. Monitor Terraform logs: Look for unusual SQL queries or DDL statements in Snowflake's QUERY_HISTORY view that originate from the Terraform provider's service account.

2. Audit workspace variables: Review all Terraform workspace variables for suspicious patterns, especially those containing SQL keywords or special characters.

3. Implement input validation: Add pre-processing in CI/CD pipelines to validate and sanitize workspace variables before they reach the Terraform provider.

4. Use least privilege: Ensure the Snowflake service account used by Terraform has only the minimum required privileges. Avoid using ACCOUNTADMIN for Terraform operations.

5. Enable MFA: Enforce multi-factor authentication for all Snowflake users, especially those created by Terraform.

6. Monitor for new users: Set up alerts for the creation of new Snowflake users, especially those with elevated privileges.

Detection Query for Snowflake:

-- Detect suspicious SQL injection patterns
SELECT 
    query_id,
    query_text,
    user_name,
    role_name,
    start_time
FROM SNOWFLAKE.ACCOUNT_USAGE.QUERY_HISTORY
WHERE 
    query_text ILIKE '%';%' 
    OR query_text ILIKE '%--%'
    OR query_text ILIKE '%DROP%'
    OR query_text ILIKE '%ALTER ACCOUNT%'
    AND user_name = 'TERRAFORM_SERVICE_ACCOUNT'
ORDER BY start_time DESC;

Indicators of Compromise (IOCs)

• Network IOCs:

  • Unusual outbound connections from the Snowflake environment to external IPs (data exfiltration).
  • Connections to known data exfiltration services (e.g., pastebin, cloud storage).

• File IOCs:

  • Unexpected CSV or JSON files in Snowflake stages (e.g., @my_stage/exfiltrated_data.csv).
  • Modified Terraform state files containing suspicious SQL or DDL payloads.

• Snowflake IOCs:

  • New user accounts created outside of normal change management processes.
  • User accounts with MUST_CHANGE_PASSWORD = FALSE and no MFA.
  • Queries containing SQL injection patterns (e.g., ';, --, UNION).
  • DDL statements executed by the Terraform service account that create or alter users with attacker-controlled passwords.

• Process IOCs:

  • Terraform processes running with unexpected environment variables.
  • CI/CD pipeline logs showing modified workspace variables with SQL injection payloads.

Detection Engineering

YARA Rule

rule Detect_Snowflake_Terraform_SQL_Injection {
    meta:
        description = "Detects SQL injection patterns in Snowflake Terraform provider logs"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-15067"
        severity = "critical"
    strings:
        $sql_injection1 = "';" ascii wide nocase
        $sql_injection2 = "--" ascii wide nocase
        $sql_injection3 = "UNION" ascii wide nocase
        $sql_injection4 = "DROP" ascii wide nocase
        $sql_injection5 = "ALTER ACCOUNT" ascii wide nocase
        $terraform_provider = "snowflake" ascii wide nocase
        $terraform_resource = "snowflake_user" ascii wide nocase
    condition:
        ($terraform_provider or $terraform_resource) and
        (any of ($sql_injection*))
}

Sigma Rule

title: Snowflake Terraform Provider SQL Injection Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against Snowflake Terraform provider
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-15067
logsource:
    product: snowflake
    service: query_history
detection:
    selection:
        user_name: "TERRAFORM_SERVICE_ACCOUNT"
        query_text|contains:
            - "';"
            - "--"
            - "UNION"
            - "DROP"
            - "ALTER ACCOUNT"
    condition: selection
falsepositives:
    - Legitimate use of SQL comments in queries
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-15067 Snowflake Terraform SQL Injection Data Exfiltration"; flow:to_server,established; content:"';"; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; content:"SNOWFLAKE"; nocase; within:100; reference:cve,2026-15067; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade the Snowflake Terraform Provider to version 2.18.0 or later. This is the only complete fix.

   terraform init -upgrade
   

2. Rotate all credentials that may have been exposed, including:

   • Snowflake service account passwords and keys.
   • Terraform workspace variables and secrets.
   • CI/CD pipeline tokens.

3. Audit Snowflake user accounts for any unauthorized users created during the exposure window. Use the following query:

   SELECT * FROM SNOWFLAKE.ACCOUNT_USAGE.USERS 
   WHERE CREATED_ON > '2026-01-01' 
   AND CREATED_BY = 'TERRAFORM_SERVICE_ACCOUNT';
   

4. Review Snowflake query history for any suspicious queries executed by the Terraform service account.

Long-term Mitigations:

1. Implement input validation in CI/CD pipelines to sanitize workspace variables before they reach Terraform.

2. Use parameterized queries in any custom Terraform providers or scripts.

3. Apply least privilege to the Snowflake service account used by Terraform. Create a custom role with only the necessary permissions.

4. Enable Snowflake's built-in security features:

   • Network policies to restrict access.
   • MFA for all users.
   • Session policies to limit session duration.

5. Monitor for new vulnerabilities in the Snowflake Terraform Provider and subscribe to security advisories.

6. Implement Infrastructure as Code (IaC) scanning tools (e.g., Checkov, tfsec) to detect insecure configurations.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert