CVE-2024-34715Low· 2.3▾ SunlitFides Webserver Logs Hosted Database Password Partial Exposure Vulnerability
▾ Sunlit zone — Low / medium · no exploitation signal
impact 12.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.3%
Last analysed / modified upstream
The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as @ and $, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.
This is caused by improper escaping of the SQLAlchemy password string, see here and here for more info.
Partial exposure of hosted database password in webserver logs
The vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat.
There are no workarounds.
@ or $ e.g. p@sswordfides | 2024-02-28 14:27:52.609 | ERROR | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name "ssword@fides-db" to address: Name or service not known
ethyca-fides < 2.37.0Upgrade to a patched release:
ethyca-fides 2.37.0Connected by shared product, vendor, weakness, or advisory.
CVE-2023-36827High· 7.5ethyca-fides Webserver API Path Traversal vulnerability
CVE-2026-42303MediumEthyca Fides has a Privacy Request Identity Verification Bypass Vulnerability via Duplicate Detection
CVE-2026-44541Highethyca-fides has a DOM-based XSS vulnerability in fides.js via fides_description override
CVE-2024-52008Medium· 5.7Password Policy Bypass Vulnerability in Fides Webserver User Accept Invite API
CVE-2025-57766Medium· 4.8Fides' Admin UI User Password Change Does Not Invalidate Current Session
CVE-2023-46125Medium· 6.5Fides Information Disclosure Vulnerability in Config API Endpoint