CVE-2025-32382: Snowflake credentials logged by the Metabase backend
First published: Thu Apr 10 2025(Updated: )
Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Metabase | >51>=52.17.1<=54.1.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2025-32382?
CVE-2025-32382 is classified as a medium severity vulnerability.
How do I fix CVE-2025-32382?
To fix CVE-2025-32382, ensure all Snowflake connection details are purged before updating or changing them in Metabase.
What impact does CVE-2025-32382 have on Metabase users?
CVE-2025-32382 may lead to exposure of sensitive Snowflake connection details if older details are not properly purged.
Which versions of Metabase are affected by CVE-2025-32382?
CVE-2025-32382 affects Metabase versions from 51 to 54.1.5, excluding version 52.17.1.
Who is vulnerable to CVE-2025-32382?
Admins of Metabase using the affected versions who manipulate Snowflake connection details are vulnerable to CVE-2025-32382.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/title
- agent/references
- agent/description
- agent/first-publish-date
- agent/type
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/last-modified-date
- agent/event
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/metabase
- canonical/metabase