{"id":"CVE-2024-34715","aliases":["GHSA-8cm5-jfj2-26q7","PYSEC-2026-1337"],"title":"Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability","summary":"Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability","severity":"low","cvss":2.3,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N","vendor":"ethyca-fides","product":"ethyca-fides","ecosystem":"pip","affected":["ethyca-fides < 2.37.0"],"patched":["ethyca-fides 2.37.0"],"published":"2024-05-29","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:13.598455495Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-8cm5-jfj2-26q7","references":[{"url":"https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34715"},{"url":"https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c"},{"url":"https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords"},{"url":"https://github.com/ethyca/fides"},{"url":"https://github.com/sqlalchemy/sqlalchemy/discussions/6615"}],"tags":["osv","pip"],"epss":0.00275,"epssPercentile":0.2019,"ingestedAt":"2026-07-08T18:25:47.442Z","slug":"CVE-2024-34715","body":"## Overview\n\nThe Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.\n\nThis is caused by improper escaping of the SQLAlchemy password string, see [here](https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords) and [here](https://github.com/sqlalchemy/sqlalchemy/discussions/6615) for more info.\n\n### Impact\nPartial exposure of hosted database password in webserver logs\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of Concept\n1. Create a hosted PostgreSQL database for Fides with a password including `@` or `$` e.g. `p@ssword`\n2. Run Fides and observe failure, sample log attached\n\n```\nfides  | 2024-02-28 14:27:52.609 | ERROR    | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name \"ssword@fides-db\" to address: Name or service not known\n```\n\n## Affected packages\n\n- `ethyca-fides < 2.37.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `ethyca-fides 2.37.0`","depth":"sunlit","depthScore":13,"depthScoreParts":{"impact":12.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}