What’s Vulnerable › Vulnerabilities

CVE-2025-46329: Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs

• Severity: low (CVSS 3.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-04-29 · updated 2026-06-17
• Weakness: CWE-532

Description

libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0.

Affected products

• Snowflake Connector For C/C++: from 0.5.0 before 2.2.0 — fixed in 2.2.0

How to fix

Upgrade to a fixed version: Snowflake Connector For C/C++ 2.2.0. Check the vendor advisory for mitigations.

References

• https://github.com/snowflakedb/libsnowflakeclient/commit/3caa8a6a3ee95e0a66ead03b4bf6a2d1ca42ebfe
• https://github.com/snowflakedb/libsnowflakeclient/security/advisories/GHSA-jx4f-645p-wjpx

Get alerted when CVE-2025-46329 or the next vulnerability affects your stack