Snowflake Terraform Provider CVE-2026-15067

For the SQL injection path the attacker must be able to influence a workspace/pipeline variable in a Terraform pipeline where the vulnerable data source is explicitly enabled - this specific data source being configured and the attacker having write influence over its variable input is the required, non-default precondition. For the DDL-injection path the attacker must be able to control identifier content passed into user-resource inputs that the provider compiles into user-management statements. Limiting factors: exploitation is authenticated (CVSS PR:L) and requires access to the IaC pipeline/variable layer rather than an anonymous internet request, no user interaction is needed (UI:N), and the impact executes with whatever privilege the operator granted the provider's Snowflake session - so a least-privilege provider role materially reduces blast radius.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 8.8) marks this network-reachable, low-complexity, low-privilege with high confidentiality/integrity/availability impact. However, the description adds material constraints the raw vector understates: the SQLi path requires an attacker to influence a workspace variable in a pipeline where the vulnerable data source is enabled - a non-default, insider- or supply-chain-adjacent precondition that pushes real-world complexity higher than AC:L implies. There is no EPSS score, no KEV listing, and no POC in the provided data, so this is a high-CVSS finding whose practical exploitation depends on privileged CI/CD access rather than opportunistic internet-wide attack. The tags (SQLi, Information Disclosure, Hashicorp) corroborate the injection/data-exposure characterization. Net: a genuine priority for organizations running Snowflake IaC pipelines with untrusted contributors, but not a mass-exploitation, drop-everything issue absent evidence of active exploitation.

An attacker with the ability to contribute to or influence a Terraform CI/CD pipeline sets a malicious value in a workspace variable that feeds the vulnerable data source; on the next plan/apply the provider concatenates that value into SQL and executes it under the privileged Snowflake session, letting the attacker read sensitive tables and create a long-lived personal access token or user. No public exploit code was identified, and the network attack vector is gated by needing write influence over pipeline variables (PR:L, authenticated).