CVE-2025-32382

Metabase is an open source Business Intelligence and Embedded Analytics tool. When admins change Snowflake connection details in Metabase (either updating a password or changing password to private key or vice versa), Metabase would not always purge older Snowflake connection details from the application database. In order to remove older and stale connection details, Metabase would try one connection method at a time and purge all the other connection methods from the application database. When Metabase found a connection that worked, it would log (log/infof "Successfully connected, migrating to: %s" (pr-str test-details)) which would then print the username and password to the logger. This is fixed in 52.17.1, 53.9.5 and 54.1.5 in both the OSS and enterprise editions. Versions 51 and lower are not impacted.

• CWE-532

• https://github.com/metabase/metabase/security/advisories/GHSA-832j-56xw-5p7f

Published

Apr 10, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-32377Rasa Pro is a framework for building scalable, dynamic conve…6.5
• CVE-2025-32378Shopware is an open source e-commerce software platform. Pri…5.3
• CVE-2025-32379Koa is expressive middleware for Node.js using ES2017 async …6.1
• CVE-2025-3238A vulnerability classified as critical has been found in PHP…9.8
• CVE-2025-32380The Apollo Router Core is a configurable, high-performance g…7.5
• CVE-2025-32381XGrammar is an open-source library for efficient, flexible, …6.5
• CVE-2025-32383MaxKB (Max Knowledge Base) is an open source knowledge base …7.2
• CVE-2025-32385EspoCRM is an Open Source Customer Relationship Management s…6.5
• CVE-2025-32386Helm is a tool for managing Charts. A chart archive file can…6.5
• CVE-2025-32387Helm is a package manager for Charts for Kubernetes. A JSON …6.5
• CVE-2025-32388SvelteKit is a framework for rapidly developing robust, perf…5.4
• CVE-2025-32389NamelessMC is a free, easy to use & powerful website softwar…6.5