TI-2025-18506 Aliases CVE-2025-24789 GHSA-7hpq-3g6w-pvhf

Snowflake JDBC allows an untrusted search path on Windows

LOW 36CWE-426Published 2025-01-29 · Updated 2025-02-12

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-426.

Summary

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. When the EXTERNALBROWSER authentication method is used on Windows, an attacker with write access to a directory in the %PATH% can escalate their privileges to the user that runs the vulnerable JDBC Driver version. This vulnerability affects versions 3.2.3 through 3.21.0 on Windows. Snowflake fixed the issue in version 3.22.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00256 17th percentileScored 2026-11-07

Fix Fixed snowflake-jdbc (snowflakedb): 3.22.0net.snowflake:snowflake-jdbc (Maven): 3.22.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Snowflake	snowflake-jdbc	3.2.3 to before 3.22.0	3.22.0	Patch available	CNA
—	net.snowflake:snowflake-jdbc (Maven)	3.2.3 to before 3.22.0	3.22.0	Patch available	GHSA-7hpq-3g6w-pvhf

snowflake-jdbc VendorSnowflake Affected 3.2.3 to before 3.22.0 Fixed in 3.22.0 Patch available CNA
net.snowflake:snowflake-jdbc (Maven) Vendor— Affected 3.2.3 to before 3.22.0 Fixed in 3.22.0 Patch available GHSA-7hpq-3g6w-pvhf

CPE configurations NVD · 2

CPE	Versions	Role	Vendor
cpe:2.3:a:snowflake:snowflake_jdbc::::::::	3.2.3 to before 3.22.0	Vulnerable	Snowflake
cpe:2.3:o:microsoft:windows:-:::::::*	not specified by NVD	Running on	Microsoft

cpe:2.3:a:snowflake:snowflake_jdbc:*:*:*:*:*:*:*:* Versions 3.2.3 to before 3.22.0 Vulnerable ·Snowflake
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

Fix · CNA snowflake-jdbc (snowflakedb) Fixed in 3.22.0
Fix · GHSA-7hpq-3g6w-pvhf net.snowflake:snowflake-jdbc (Maven) Fixed in 3.22.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2025-24789
2026-10-03 Alias added: GHSA-7hpq-3g6w-pvhf

References

Patch 1

https://github.com/snowflakedb/snowflake-jdbc/commit/4f01bb8f9b708c71e7a2111c87371dbfc1d53dd6

Advisory 2

Other 1

https://github.com/snowflakedb/snowflake-jdbc

TI-2026-02844 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos CVSS 4.0MEDIUM 4.8
TI-2023-14370 Snowflake JDBC vulnerable to command injection via SSO URL authentication CVSS 3.1HIGH 8.8
TI-2024-29031 Snowflake JDBC driver versions >= 3.2.6 and <= 3.19.1 have an Incorrect Security Setting… CVSS 3.1MEDIUM 5.9
TI-2025-18507 Snowflake JDBC uses insecure temporary credential cache file permissions CVSS 3.1MEDIUM 5.5
TI-2025-20331 Snowflake JDBC Driver client-side encryption key in DEBUG logs CVSS 3.1LOW 3.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences