### Critical Vulnerability Information #### Vulnerability Title Snowflake credentials logged by the Metabase backend #### Affected Versions - **Affected Versions**: 0.52.12-0.52.17.1, 0.52.12-1.52.17.1, 0.53.2.3-0.53.9.5, 1.52.17.1, 0.53.2.3-0.53.9.5, <0.54.1.5, 1.53.2.3-1.53.9.5, <0.54.1.5, <1.54.1.5 - **Fixed Versions**: 0.52.17.1, 0.53.9.5, 0.54.1.5, 1.52.17.1, 1.53.9.5, 1.54.1.5 #### Description - **Impact**: Under certain conditions, Metabase instances connected to a Snowflake data warehouse may log username and password details. The logs are generated by the Metabase backend, defaulting to console logging, and users can override this via the log4j2.xml configuration file. - **Details**: When an administrator changes Snowflake connection details in Metabase, the system does not always clear the old Snowflake connection information. To remove outdated connection details, Metabase attempts a connection method and clears all other connection methods. When a valid connection is found, it logs information containing the username and password. #### Mitigation - **Fixed Versions**: 52.17.1, 53.9.5, and 54.1.5 (for both OSS and Enterprise editions) - **Workaround**: Change the log level in log4j2.xml to WARN to prevent logging of Snowflake credentials. #### Severity - **CVSS v4 Base Metrics** - Attack Vector: Network - Attack Complexity: Low - Attack Requirements: Existence - Required Privileges: High - User Interaction: Active - Affected System Impact Metric: None - Secondary System Impact Metric: Low - **CVE ID**: CVE-2025-32382 - **Weakness**: No CWEs