{"id":"CVE-2025-24795","aliases":["GHSA-r2x6-cjg7-8r43","PYSEC-2025-28"],"title":"snowflake-connector-python vulnerable to insecure cache files permissions","summary":"snowflake-connector-python vulnerable to insecure cache files permissions","severity":"medium","cvss":4.4,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","vendor":"snowflake-connector-python","product":"snowflake-connector-python","ecosystem":"pip","affected":["snowflake-connector-python >= 2.3.7, < 3.13.1"],"patched":["snowflake-connector-python 3.13.1"],"published":"2025-01-29","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:50:22.180562894Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-r2x6-cjg7-8r43","references":[{"url":"https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-24795"},{"url":"https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/snowflake-connector-python/PYSEC-2025-28.yaml"},{"url":"https://github.com/snowflakedb/snowflake-connector-python"},{"url":"https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.13.1"}],"tags":["osv","pip"],"epss":0.0014,"epssPercentile":0.03728,"ingestedAt":"2026-09-12T03:13:01.724Z","slug":"CVE-2025-24795","body":"## Overview\n\n### Issue\nSnowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file.\n\nThis vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.\n\n### Vulnerability Details\nOn Linux, when either EXTERNALBROWSER or USERNAME_PASSWORD_MFA authentication methods are used with temporary credential caching enabled, the Snowflake Connector for Python will cache the temporary credentials in a local file. In the vulnerable versions of the Driver, this file is created with world-readable permissions.\n\n### Solution\nSnowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.\n\n### Additional Information\nIf you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our [Vulnerability Disclosure Policy](https://hackerone.com/snowflake?type=team).\n\n## Affected packages\n\n- `snowflake-connector-python >= 2.3.7, < 3.13.1`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `snowflake-connector-python 3.13.1`","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":24.2,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}