CVE-2026-15067
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
Snowflake Terraform Provider versions prior to 2.18.0 contain SQL injection and DDL injection vulnerabilities. An attacker can exploit unsanitized data source inputs to execute arbitrary SQL queries with the provider's privileged session, enabling data exfiltration and creation of long-lived access credentials. Improper identifier sanitization in user resources allows DDL injection, potentially creating accounts with attacker-controlled credentials.
Risk Assessment
The risk includes unauthorized access to sensitive data in Snowflake, privilege escalation, and persistent security compromise through creation of accounts with attacker-controlled credentials, potentially leading to long-term environment compromise.
Recommendation
Immediately upgrade Snowflake Terraform Provider to version 2.18.0 or later. The fix requires manual upgrade as it is not automatically applied.
Related vulnerabilities
- CVE-2026-85440Critical
Pre-authentication heap overflow vulnerability in MOOS core-moos through 10.4.0 in MOOSCommPkt packet handling. Attackers can declare a negative packet length, leading to writing arbitrary data past a four-byte heap buffer during the HandShake phase.
- CVE-2026-85438Critical
Buffer overflow vulnerability in MOOS-IvP through 24.8.1 in StringToIvPFunction(), where dimension, piece, and degree counts from encoded BHV_IPF payloads are used without validation. Attackers can supply crafted payloads to write past the IvPBox weight array.
- CVE-2026-85437Critical
Multiple buffer overflow vulnerabilities in MOOS-IvP through 24.8.1 in IvP function string decoders that trust attacker-controlled length fields. Crafted encoded strings can overflow heap and stack buffers, potentially enabling remote code execution.
- CVE-2026-85435Critical
MOOS-IvP uFldNodeBroker through 24.8.1 fails to validate the source of TRY_SHORE_HOST messages, allowing any publisher to enroll attacker-controlled shore routes. Attackers can receive bridged vehicle traffic including sensor data and control information.
- CVE-2026-85434Critical
MOOS-IvP uFldShoreBroker through 24.8.1 fails to verify node ping authenticity before creating outbound bridge routes. Attackers can publish NODE_BROKER_PING messages with crafted HostRecord data to redirect bridged variables to attacker-controlled addresses.
- CVE-2026-85433Critical
MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted messages to open new listeners and redirect or duplicate traffic.
- CVE-2026-85430Critical
MOOS essential-moos through 10.0.1 contains an authentication bypass in pShare that accepts UDP datagrams from any source and republishes them with attacker-claimed identity. Attackers can inject messages under spoofed identities or crash the pShare process.
- CVE-2026-85428Critical
MOOS core-moos through 10.4.0 contains an authentication bypass in the optional MOOSDB HTTP server, allowing unauthenticated clients to write variables. Attackers can modify MOOS variables including actuator and override commands without authentication.
- CVE-2026-85426Critical
MOOS-IvP uMemWatch through 24.8.1 constructs shell commands from attacker-chosen MOOS client names without sanitization. Attackers can inject shell metacharacters to execute arbitrary commands as the uMemWatch process user.
- CVE-2026-85425Critical
MOOS-IvP iSay through 24.8.1 contains a remote code execution vulnerability in the SAY_MOOS variable handler that passes unsanitized text to a shell command. Attackers can publish messages with command substitution syntax to execute arbitrary commands as the iSay process user.
Original NVD description (English source)
Snowflake Terraform Provider versions prior to 2.18.0 contain several security vulnerabilities, including SQL injection via an unsanitized data source input could result in arbitrary SQL execution under the provider's privileged Snowflake session, potentially enabling sensitive data exfiltration and minting of long-lived access credentials. Exploitation requires the ability for an attacker to influence a workspace variable in a pipeline where this data source was enabled. Improper neutralization of identifier content in user resource inputs could allow DDL injection into user management statements, potentially causing accounts to be created with attacker-controlled credentials and without the security controls configured by the operator. The fix is available in Snowflake Terraform Provider version 2.18.0. Users must manually upgrade.