CVE-2026-15067 describes SQL injection and DDL injection vulnerabilities in the Snowflake Terraform Provider for Snowflake versions prior to 2.18.0. The SQL injection arises from unsanitized data source inputs, enabling arbitrary SQL execution under the provider's privileged Snowflake session. The DDL injection vulnerability stems from improper neutralization of identifier content in user resource inputs, potentially allowing attackers to create accounts with malicious credentials and circumvent configured security controls. Exploitation requires the attacker to influence a workspace variable in a pipeline where the vulnerable data source is enabled. The vendor has released version 2.18.0 containing fixes for these vulnerabilities.

Successful exploitation can lead to arbitrary SQL command execution with elevated privileges, resulting in sensitive data exfiltration and unauthorized creation of user accounts with attacker-controlled credentials. This compromises confidentiality, integrity, and availability of the Snowflake environment managed by the Terraform provider.

A fix is available in Snowflake Terraform Provider version 2.18.0. Users must manually upgrade to this version or later to remediate these vulnerabilities. Since this is a cloud service, the vendor manages remediation for the cloud-hosted components, but the provider software used by customers requires manual upgrading.