CVSS 3.1
3.3 lowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:NCVE-2025-27496
Low (3.3) in snowflake snowflake jdbc. EPSS 0.1% chance of exploitation in the next 30 days. Fixed in net.snowflake:snowflake-jdbc 3.23.1.
Snowflake, a platform for using artificial intelligence in the context of cloud computing, has a vulnerability in the Snowflake JDBC driver ("Driver") in versions 3.0.13 through 3.23.0 of the driver. When the logging level was set to DEBUG, the Driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. Snowflake fixed the issue in version 3.23.1.
Severity
- EPSS
- 0.1% chance of exploitation in the next 30 days; higher than 1% of CVEs (scores of 2026-10-31)
- CWE
- CWE-532
- Published
- Modified
- Record from
- the NVD, synced
Affected
- snowflake:snowflake_jdbc
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-q298-375f-5q63 | Maven | net.snowflake:snowflake-jdbc | >=3.0.13 <3.23.1 | 3.23.1 |