Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover (CVE-2026-15067) | HOL Guard CVE

High · CVSS 8.8CVE-2026-15067

Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover

Answer in brief

CVE-2026-15067 records a High severity (CVSS 8.8) vulnerability in Multiple Security Vulnerabilities in Terraform Provider for Snowflake Could Allow Privilege Escalation and Unauthorized Snowflake Account Takeover. The current sources do not mark it as known exploited. The current feed maps Snowflake/Terraform Provider for Snowflake (generic). Check affected ranges and fixed versions before updating.

Analysis pending evidence review

HOL Guard separates source facts from reviewed analysis. See the methodology.

Published Jul 8, 2026Updated Jul 9, 2026Source checked Sep 19, 2026First seen by HOL Jul 8, 2026Material review Jul 9, 2026

Upstream Advisory

Key facts

Risk: High · CVSS 8.8
Exploitation: Not marked as known exploited
Affected software: 1 mapped package or product
Fix availability: Available

Why this deserves its current priority

CVSS is 8.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.

Analysis status

Analysis pending evidence review

Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.

Affected scope and exposure questions

The current feed maps Snowflake/Terraform Provider for Snowflake (generic). Check affected ranges and fixed versions before updating.

Mapped affected packages and fixed versions
Package	Affected range	Fixed version
Snowflake/Terraform Provider for Snowflakegeneric	>=0.1.0 <2.18.0	2.18.0

Recommended response

Check inventory. Check lockfiles and deployed manifests for Snowflake/Terraform Provider for Snowflake.
Review the reported fix. Update Snowflake/Terraform Provider for Snowflake to 2.18.0 if you use the affected versions. Test the change in a non-production environment first.

Evidence timeline and material changes

Published upstream
Jul 8, 2026
Evidence: source:cvelist:source_dates:source-dates:record
Source modified
Jul 9, 2026
Evidence: source:cvelist:source_dates:source-dates:record
First seen by HOL
Jul 8, 2026

Sources and claim methodology

GitHub security advisorygithub.com

Upstream source description

Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to influence a workspace variable in a pipeline where this data source was enabled. Improper neutralization of identifier content in user resource inputs could allow DDL injection into user management statements, potentially causing accounts to be created with attacker-controlled credentials and without the security controls configured by the operator. The fix is available in Snowflake Terraform Provider version 2.18.0. Users must manually upgrade.

Quoted source text, attributed separately from HOL analysis.