CVE-2025-24790 Snowflake JDBC uses insecure temporary credential cache file permissions

What is CVE-2025-24790?

CVE-2025-24790 is a medium-severity vulnerability in snowflakedb snowflake-jdbc, published on 29 Jan 2025. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Snowflake discovered and remediated a vulnerability in the Snowflake JDBC Driver. On Linux systems, when temporary credential caching is enabled, the Snowflake JDBC Driver will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 3.6.8 through 3.21.0. Snowflake fixed the issue in version 3.22.0.

Weakness: CWE-276

Which versions are affected by CVE-2025-24790?

2 open source packages ship an affected version, including net.snowflake:snowflake-jdbc. It affects 1 product.

Products include Snowflake Snowflake Jdbc.

How do I fix CVE-2025-24790?

Upgrade net.snowflake:snowflake-jdbc to 3.22.0 or later.

Is CVE-2025-24790 being exploited?

There is no known exploitation of CVE-2025-24790 in the wild and no public exploit code.

Other vulnerabilities in snowflakedb snowflake-jdbc

• CVE-2025-24789 Snowflake JDBC allows an untrusted search path on Windows High 7.8
• CVE-2023-30535 Snowflake JDBC vulnerable to command injection via SSO URL authentication High 7.3
• CVE-2024-43382 Snowflake JDBC Security Advisory Medium 5.9
• CVE-2026-3293 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos Medium 4.8
• CVE-2025-27496 Snowflake JDBC Driver client-side encryption key in DEBUG logs Low 3.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-33g6-495w-v8j2.