CVE-2025-27496: Snowflake JDBC Driver client-side encryption key in DEBUG logs
Issue Snowflake discovered and remediated a vulnerability in the Snowflake JDBC driver (“Driver”). When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake.
This vulnerability affects Driver versions 3.0.13 through 3.23.0. Snowflake fixed the issue in version 3.23.1.
Vulnerability Details When the logging level was set to DEBUG, the Driver would locally log the client-side encryption master key of the target stage during the execution of GET/PUT commands. The key was logged in a JSON object under the queryStageMasterKey key. The key by itself does not grant access to any sensitive data.
Solution Snowflake released version 3.23.1 of the Snowflake JDBC driver, which fixes this issue. We highly recommend users upgrade to version 3.23.1.
Additional Information If you discover a security vulnerability in one of our products or websites, please report the issue to Snowflake through our Vulnerability Disclosure Program hosted at HackerOne. For more information, please see our Vulnerability Disclosure Policy.
Other sources
Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/net.snowflake:snowflake-jdbcto a version that resolves this vulnerability.Fixed in 3.23.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.23.1
Event History
Frequently Asked Questions
What are the affected versions for CVE-2025-27496?
CVE-2025-27496 affects versions 3.0.13 through 3.23.0 of the Snowflake JDBC Driver.
What is the main issue identified in CVE-2025-27496?
CVE-2025-27496 involves the Snowflake JDBC Driver logging sensitive client-side information locally when the logging level is set to DEBUG.
How can organizations mitigate the risks associated with CVE-2025-27496?
Organizations can mitigate CVE-2025-27496 by updating the Snowflake JDBC Driver to a version outside the affected range.
Is CVE-2025-27496 specific to any particular operating system?
CVE-2025-27496 is not specific to any operating system; it relates to the Snowflake JDBC Driver regardless of the platform it is used on.
What is the potential impact of exploiting CVE-2025-27496?
Exploiting CVE-2025-27496 could lead to unauthorized exposure of sensitive client-side information.