{"id":"PYSEC-2026-1337","summary":"Fides Webserver Logs Hosted Database Password Partial Exposure Vulnerability","details":"The Fides webserver requires a connection to a hosted PostgreSQL database for persistent storage of application data. If the password used by the webserver for this database connection includes special characters such as `@` and `$`, webserver startup fails and the part of the password following the special character is exposed in webserver error logs.\n\nThis is caused by improper escaping of the SQLAlchemy password string, see [here](https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords) and [here](https://github.com/sqlalchemy/sqlalchemy/discussions/6615) for more info.\n\n### Impact\nPartial exposure of hosted database password in webserver logs\n\n### Patches\nThe vulnerability has been patched in Fides version `2.37.0`. Users are advised to upgrade to this version or later to secure their systems against this threat.\n\n### Workarounds\nThere are no workarounds.\n\n### Proof of Concept\n1. Create a hosted PostgreSQL database for Fides with a password including `@` or `$` e.g. `p@ssword`\n2. Run Fides and observe failure, sample log attached\n\n```\nfides  | 2024-02-28 14:27:52.609 | ERROR    | fides.api.db.database:configure_db:117 - Unable to configure database: sqlalchemy.exc.OperationalError: (psycopg2.OperationalError) could not translate host name \"ssword@fides-db\" to address: Name or service not known\n```","aliases":["CVE-2024-34715","GHSA-8cm5-jfj2-26q7"],"modified":"2026-07-07T17:46:35.171988510Z","published":"2026-07-07T11:45:43.875883Z","references":[{"type":"WEB","url":"https://github.com/ethyca/fides/security/advisories/GHSA-8cm5-jfj2-26q7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34715"},{"type":"WEB","url":"https://github.com/ethyca/fides/commit/6ab37b1ffe2b1a3bd35b706a82f78e061086141c"},{"type":"WEB","url":"https://docs.sqlalchemy.org/en/14/core/engines.html#escaping-special-characters-such-as-signs-in-passwords"},{"type":"PACKAGE","url":"https://github.com/ethyca/fides"},{"type":"WEB","url":"https://github.com/sqlalchemy/sqlalchemy/discussions/6615"},{"type":"PACKAGE","url":"https://pypi.org/project/ethyca-fides"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-8cm5-jfj2-26q7"}],"affected":[{"package":{"name":"ethyca-fides","ecosystem":"PyPI","purl":"pkg:pypi/ethyca-fides"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.37.0"}]}],"versions":["1.9.9","2.0.0","2.1.0","2.10.0","2.11.0","2.12.0","2.12.1","2.13.0","2.14.0","2.14.1","2.14.2","2.15.0","2.15.1","2.16.0","2.17.0","2.17.1","2.18.0","2.19.0","2.19.1","2.2.0","2.2.1","2.2.2","2.20.0","2.20.1","2.20.2","2.21.0","2.22.0","2.22.1","2.23.0","2.23.1","2.23.2","2.23.3","2.24.0","2.24.1","2.25.0","2.26.0","2.26.3","2.27.0","2.28.0","2.29.0","2.3.0","2.3.1","2.30.0","2.30.1","2.31.0","2.32.0","2.33.0","2.33.1","2.34.0","2.35.0","2.35.1","2.36.0","2.4.0","2.5.0","2.5.1","2.6.0","2.6.1","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.7.0","2.7.1","2.8.0","2.8.1","2.8.2","2.8.3","2.9.0","2.9.1","2.9.2"],"database_specific":{"source":"https://github.com/pypa/advisory-database/blob/main/vulns/ethyca-fides/PYSEC-2026-1337.yaml"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N"}]}