Snowflake JDBC Driver logs client-side encryption key at DEBUG level (CVE-2025-27496)
The Snowflake JDBC driver versions 3.0.13 through 3.23.0 logged client-side encryption keys in DEBUG mode, potentially exposing sensitive encryption material. The vulnerability was patched in version 3.23.1.
What happened
When the logging level was set to DEBUG, the Snowflake JDBC driver would log locally the client-side encryption master key of the target stage during the execution of GET/PUT commands.
The key was logged in a JSON object under the queryStageMasterKey key. The key by itself does not grant access to any sensitive data without additional access authorizations, and is not logged server-side by Snowflake.
Reported impact
The vulnerability affected JDBC driver versions 3.0.13 through 3.23.0.
Index analysis
Snowflake released version 3.23.1 of the JDBC driver, which fixes the issue by masking sensitive encryption material in logs.
Classification
Sources and evidence
Sources not yet published
This record was researched and written by the Index from original reporting. Its sources are still being verified by an editor, and they are listed here once that check is complete. Until then the record carries no reviewer.