CVE-2025-46329 Snowflake Connector for C/C++ inserts client-side encryption key in DEBUG logs
Attackers with local access can read sensitive encryption keys from debug logs in the Snowflake C/C++ connector.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-46329?
CVE-2025-46329 is a low-severity vulnerability in snowflakedb libsnowflakeclient, published on 29 Apr 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
libsnowflakeclient is the Snowflake Connector for C/C++. Versions starting from 0.5.0 to before 2.2.0, are vulnerable to local logging of sensitive information. When the logging level was set to DEBUG, the Connector would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands. This key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake. This issue has been patched in version 2.2.0.
Weakness: CWE-532
Which versions are affected by CVE-2025-46329?
It affects 1 product.
Products include Snowflake Connector for C\/C\+\+.
How do I fix CVE-2025-46329?
No fix has been published for CVE-2025-46329 yet. Limit exposure of the affected software until one is available.
Is CVE-2025-46329 being exploited?
There is no known exploitation of CVE-2025-46329 in the wild and no public exploit code.
Other vulnerabilities in snowflakedb libsnowflakeclient
Sources
Also known as GHSA-jx4f-645p-wjpx.