CVE-2024-35189

Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpoints are not meant to expose that sensitive data in plaintext to API clients, as it could be compromising. Fides's developers have available to them a Pydantic field-attribute (`sensitive`) that they can annotate as `True` to indicate that a given secret field should not be exposed via the API. The application has an internal function that uses `sensitive` annotations to mask the sensitive fields with a `"**********"` placeholder value. This vulnerability is due to a bug in that function, which prevented `sensitive` API model fields that were _nested_ below the root-level of a `secrets` object from being masked appropriately. Only the `BigQuery` connection configuration secrets meets these criteria: the secrets schema has a nested sensitive `keyfile_creds.private_key` property that is exposed in plaintext via the APIs. Connection types other than `BigQuery` with sensitive fields at the root-level that are not nested are properly masked with the placeholder and are not affected by this vulnerability. This vulnerability has been patched in Fides version 2.37.0. Users are advised to upgrade to this version or later to secure their systems against this threat. Users are also advised to rotate any Google Cloud secrets used for BigQuery integrations in their Fides deployments. There are no known workarounds for this vulnerability.

• CWE-200
• CWE-201

• https://cloud.google.com/iam/docs/key-rotationNot Applicable
• https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7cExploit, Vendor Advisory
• https://cloud.google.com/iam/docs/key-rotationNot Applicable
• https://github.com/ethyca/fides/security/advisories/GHSA-rcvg-jj3g-rj7cExploit, Vendor Advisory

Published

May 30, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-35182Meshery is an open source, cloud native manager that enables…8.1
• CVE-2024-35183wolfictl is a command line tool for working with Wolfi. A gi…4.4
• CVE-2024-35184Paperless-ngx is a document management system that transform…5.5
• CVE-2024-35185Minder is a software supply chain security platform. Prior t…5.3
• CVE-2024-35186gitoxide is a pure Rust implementation of Git. During checko…8.8
• CVE-2024-35187Stalwart Mail Server is an open-source mail server. Prior to…9.1
• CVE-2024-3519The Media Library Assistant plugin for WordPress is vulnerab…6.1
• CVE-2024-35190Asterisk is an open source private branch exchange and telep…5.3
• CVE-2024-35191Formie is a Craft CMS plugin for creating forms. Prior to 2.…4.4
• CVE-2024-35192Trivy is a security scanner. Prior to 0.51.2, if a malicious…5.5
• CVE-2024-35194Minder is a software supply chain security platform. Prior t…5.3
• CVE-2024-35195Requests is a HTTP library. Prior to 2.32.0, when making req…5.6