CVE-2025-24795: The Snowflake Connector for Python uses insecure cache files permissions
Issue Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file.
This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
Vulnerability Details On Linux, when either EXTERNALBROWSER or USERNAMEPASSWORDMFA authentication methods are used with temporary credential caching enabled, the Snowflake Connector for Python will cache the temporary credentials in a local file. In the vulnerable versions of the Driver, this file is created with world-readable permissions.
Solution Snowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.
Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Other sources
The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-24795?
CVE-2025-24795 is a high severity vulnerability due to the exposure of cached temporary credentials in a world-readable file.
How do I fix CVE-2025-24795?
To fix CVE-2025-24795, upgrade the Snowflake Connector for Python to version 3.13.1 or later.
What systems are affected by CVE-2025-24795?
CVE-2025-24795 affects the Snowflake Connector for Python installed on Linux systems with temporary credential caching enabled.
What are the risks associated with CVE-2025-24795?
The risks associated with CVE-2025-24795 include unauthorized access to sensitive data due to the exposure of temporary credentials.
Is CVE-2025-24795 present in earlier versions of the Snowflake Connector for Python?
Yes, CVE-2025-24795 is present in versions ranging from 2.3.7 to 3.13.0 of the Snowflake Connector for Python.