CVE-2025-24790: Snowflake JDBC uses insecure temporary credential cache file permissions
Issue Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file.
This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.
Vulnerability Details On Linux, when either EXTERNALBROWSER or USERNAMEPASSWORDMFA authentication methods are used with temporary credential caching enabled, the Snowflake JDBC Driver will cache temporary credentials in a local file. In the vulnerable versions of the Driver, this file is created with world-readable permissions.
Solution Snowflake released version 3.22.0 of the Snowflake JDBC Driver, which fixes this issue. We recommend users upgrade to version 3.22.0.
Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Other sources
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24790?
The severity of CVE-2025-24790 is considered to be high due to the risk of exposing sensitive temporary credentials.
How do I fix CVE-2025-24790?
To fix CVE-2025-24790, you should upgrade the Snowflake JDBC Driver to version 3.22.0 or later.
What are the affected versions of the Snowflake JDBC Driver for CVE-2025-24790?
The affected versions for CVE-2025-24790 are from 3.6.8 to 3.21.0 of the Snowflake JDBC Driver.
What is the impact of CVE-2025-24790 on Linux systems?
CVE-2025-24790 allows caching of temporary credentials in a world-readable file, which can lead to unauthorized access.
Is temporary credential caching vulnerable in all environments due to CVE-2025-24790?
No, the vulnerability specifically affects Linux systems where temporary credential caching is enabled in the Snowflake JDBC Driver.