Security: ConnectionPool.__repr__ leaks password in plaintext (CWE-532) #3993

Security Vulnerability Report

Severity: MEDIUM (CVSS 5.5)
CWE: CWE-532 — Insertion of Sensitive Information into Log File
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Reporter: Conner Webber ([email protected])
90-day disclosure deadline: 2026-06-06

Note: I attempted to file this via GitHub's Private Vulnerability Reporting (PVRA), but it is not enabled on this repository. I also checked for a SECURITY.md — none exists for redis-py. The main redis/redis SECURITY.md points to [email protected] which I am also contacting. Filing here so the maintainers are aware.

Summary

ConnectionPool.__repr__() in redis/connection.py (lines 2848-2854) iterates over all connection_kwargs and includes them in the string representation — including password.

When a Redis connection is created with a password (via URL or explicit password= parameter), the password is stored in connection_kwargs['password']. Any code path that triggers repr() on a ConnectionPool instance will expose the Redis password in plaintext.

The Connection class itself is not affected — its repr_pieces() method (lines 1465-1469) deliberately excludes the password field. ConnectionPool.__repr__ was missed when that mitigation was added.

Affected Code

# redis/connection.py:2848-2854
def __repr__(self) -> str:
    conn_kwargs = ",".join([f"{k}={v}" for k, v in self.connection_kwargs.items()])
    return (...)

Steps to Reproduce

import redis
import logging

logging.basicConfig(level=logging.DEBUG)

pool = redis.ConnectionPool.from_url('redis://:MySecretPassword@localhost:6379/0')
print(repr(pool))  # Password visible in output
logging.debug('Pool state: %r', pool)  # Password written to log file

Impact

Redis passwords are exposed in:

• Application log files (any framework that logs connection objects)
• Error tracking services (Sentry, Datadog, etc.)
• Debugger output
• Tracebacks printed to stderr
• Monitoring dashboards

This is especially impactful in cloud/containerized environments where logs are aggregated and accessible to operations teams who should not have database credentials.

Suggested Fix

Filter sensitive keys from connection_kwargs in __repr__, consistent with how Connection.repr_pieces() already handles it:

def __repr__(self) -> str:
    SENSITIVE_KEYS = {'password', 'credential_provider'}
    conn_kwargs = ",".join(
        [f"{k}={'***' if k in SENSITIVE_KEYS else v}"
         for k, v in self.connection_kwargs.items()]
    )
    return (...)

Affected Versions

All current versions of redis-py that include ConnectionPool.__repr__.