Read the docs
TI-2024-33218 Aliases CVE-2024-49750GHSA-5vvg-pvhp-hv2m

Snowflake Connector for Python has sensitive data in logs

Priority LOW 24CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-532.

Summary

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Prior to version 3.12.3, when the logging level was set by the user to DEBUG, the Connector could have logged Duo passcodes (when specified via the `passcode` parameter) and Azure SAS tokens. Additionally, the SecretDetector logging formatter, if enabled, contained bugs which caused it to not fully redact JWT tokens and certain private key formats. Snowflake released version 3.12.3 of the Snowflake Connector for Python, which fixes the issue. In addition to upgrading, users should review their logs for any potentially sensitive information that may have been captured.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00202 10th percentileScored 2026-11-07
Fix Fixed snowflake-connector-python (snowflakedb): 3.12.3snowflake-connector-python (PyPI): 3.12.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Snowflakesnowflake-connector-pythonbefore 3.12.33.12.3Patch availableCNA
—snowflake-connector-python (PyPI)before 3.12.33.12.3Patch availableGHSA-5vvg-pvhp-hv2m
  • snowflake-connector-python VendorSnowflake Affected before 3.12.3 Fixed in 3.12.3 Patch available CNA
  • snowflake-connector-python (PyPI) Vendor— Affected before 3.12.3 Fixed in 3.12.3 Patch available GHSA-5vvg-pvhp-hv2m

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:*before 3.12.3VulnerableSnowflake
  • cpe:2.3:a:snowflake:snowflake_connector:*:*:*:*:*:python:*:* Versions before 3.12.3 Vulnerable ·Snowflake

Remediation

  • Fix · CNA snowflake-connector-python (snowflakedb) Fixed in 3.12.3
  • Fix · GHSA-5vvg-pvhp-hv2m snowflake-connector-python (PyPI) Fixed in 3.12.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-49750
  2. 2026-10-03 Alias added: GHSA-5vvg-pvhp-hv2m

References

Patch 1

Advisory 2

Other 2

  • TI-2022-20945 Exponential ReDoS in snowflake-connector-python leads to denial of service CVSS 3.1HIGH 7.5
  • TI-2023-17069 Snowflake Python Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17068 Snowflake NodeJS Driver vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2023-17066 Snowflake Connector vulnerable to Command Injection CVSS 3.1HIGH 8.8
  • TI-2025-18511 The Snowflake Connector for Python uses insecure deserialization of the OCSP response cache CVSS 3.1HIGH 7.8
  • TI-2025-18510 Snowflake Connector for Python has an SQL Injection in write_pandas CVSS 3.1HIGH 7.0
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences