# CVE-2024-35189: Sensitive Data Disclosure Vulnerability in Connection Configuration Endpoints in Fides > Attackers can retrieve unmasked BigQuery private keys from API endpoints due to a masking bug in Fides, exposing sensitive cloud credentials. - **Severity:** Medium 6.5 (`CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N`) - **Exploited in the wild:** Not known - **Login needed:** Any signed-in user - **Attackable:** Over the internet - **Victim action needed:** Not needed - **Fix available:** Yes - **Published:** 30 May 2024 - **Updated:** 2 Aug 2024 - **Also known as:** GHSA-rcvg-jj3g-rj7c, PYSEC-2026-1346 ## What is CVE-2024-35189? CVE-2024-35189 is a medium-severity vulnerability in ethyca fides, published on 30 May 2024. Any signed-in user can exploit it over the network, with no action from the victim. ### Official description Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `"**********"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability. Weakness: CWE-201 (Insertion of Sensitive Information Into Sent Data), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor) ## Which versions are affected by CVE-2024-35189? 3 open source packages ship an affected version, including ethyca-fides. It affects 1 product. | Package | Ecosystem | Affected | Fixed in | | --- | --- | --- | --- | | `ethyca-fides` | PyPI | All versions | 2.37.0 | | `ethyca-fides` | PyPI | All versions | 2.37.0 | | `ethyca-fides` | PyPI | All versions | 2.37.0 | Products: Ethyca Fides. ## How do I fix CVE-2024-35189? Upgrade ethyca-fides to 2.37.0 or later. ## Is CVE-2024-35189 being exploited? It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35189 exists. ## Other vulnerabilities in ethyca fides - [CVE-2024-45053](https://insights.sbomify.com/CVE-2024-45053/): Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine (critical 9.1) - [CVE-2023-41319](https://insights.sbomify.com/CVE-2023-41319/): Remote Code Execution in Custom Integration Upload in Fides (high 8.8) - [CVE-2025-57817](https://insights.sbomify.com/CVE-2025-57817/): Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation (high 8.6) - [CVE-2023-48224](https://insights.sbomify.com/CVE-2023-48224/): Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides (high 8.2) - [CVE-2023-46124](https://insights.sbomify.com/CVE-2023-46124/): Server-Side Request Forgery Vulnerability in Custom Integration Upload (high 8.2) ## Fix prompt for AI coding agents ```text Check this codebase for CVE-2024-35189 and fix it if it is affected. What it is: CVE-2024-35189 is a medium-severity vulnerability in ethyca fides, published on 30 May 2024. Any signed-in user can exploit it over the network, with no action from the victim. Exploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-35189 exists. Affected packages and fixed versions: - ethyca-fides (PyPI): affected all versions; fixed in 2.37.0 - ethyca-fides (PyPI): affected all versions; fixed in 2.37.0 - ethyca-fides (PyPI): affected all versions; fixed in 2.37.0 Task: 1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies. 2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it. 3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead. 4. Run the tests and summarise what changed and why. 5. If nothing in the project is affected, say so and change nothing. Reference: https://insights.sbomify.com/CVE-2024-35189/ (Markdown: https://insights.sbomify.com/CVE-2024-35189/index.md) ``` ## Sources - CVE record: https://www.cve.org/CVERecord?id=CVE-2024-35189 - NVD: https://nvd.nist.gov/vuln/detail/CVE-2024-35189 - OSV: https://osv.dev/vulnerability/CVE-2024-35189 --- From sbomify Insights: https://insights.sbomify.com/CVE-2024-35189/ Summaries are generated and may contain mistakes; the official description above is the record.