CVE-2025-24795

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. On Linux systems, when temporary credential caching is enabled, the Snowflake Connector for Python will cache temporary credentials locally in a world-readable file. This vulnerability affects versions 2.3.7 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

• CWE-276

• https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79afPatch
• https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-r2x6-cjg7-8r43Vendor Advisory

Published

Jan 29, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-2479The Easy Custom Admin Bar plugin for WordPress is vulnerable…6.1
• CVE-2025-24790Snowflake JDBC provides a JDBC type 4 driver that supports c…5.5
• CVE-2025-24791snowflake-connector-nodejs is a NodeJS driver for Snowflake.…5.5
• CVE-2025-24792Snowflake PHP PDO Driver is a driver that uses the PHP Data …4.4
• CVE-2025-24793The Snowflake Connector for Python provides an interface for…7
• CVE-2025-24794The Snowflake Connector for Python provides an interface for…7.8
• CVE-2025-24796Collabora Online is a collaborative online office suite base…6.3
• CVE-2025-24797Meshtastic is an open source mesh networking solution. A fau…9.8
• CVE-2025-24798Meshtastic is an open source mesh networking solution. From …6.5
• CVE-2025-24799GLPI is a free asset and IT management software package. An …9.8
• CVE-2025-2480Santesoft Sante DICOM Viewer Pro is vulnerable to an out-of-…8.4
• CVE-2025-24800Hyperbridge is a hyper-scalable coprocessor for verifiable, …9.3