AIKIDO-2026-366626

snowflake-connector-python is vulnerable to Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File Pre-CVE Published 3 days ago

Low Risk

This Affects:

snowflake-connector-python

2.4.2 - 4.7.2

Fixed in 4.7.3

Are you affected? Scan for Free

TL;DR

Connector logging writes sensitive values in clear text, including raw SQL statement text, request Authorization headers, OAuth access and refresh tokens, one-time passcodes, and the per-result qrmk result-encryption key. These values appear in DEBUG records and some ERROR records emitted regardless of log level, and are exposed to anyone able to read the application logs. No secret masking is applied to these paths by default, so the values persist in downstream log sinks. The fix masks SQL and secret patterns, logs only the presence of the qrmk and non-sensitive chunk-header metadata, and installs the masking filter on the connector loggers by default.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range and connector logs are readable by parties who should not see the credentials, tokens, keys, or SQL they contain.