diff --git a/pkg/executor/set.go b/pkg/executor/set.go
index 27288b32f6c63..301e1511147c3 100644
--- a/pkg/executor/set.go
+++ b/pkg/executor/set.go
@@ -161,7 +161,11 @@ func (e *SetExecutor) setSysVariable(ctx context.Context, name string, v *expres
 			}
 			return nil
 		})
-		logutil.BgLogger().Info("set global var", zap.Uint64("conn", sessionVars.ConnectionID), zap.String("name", name), zap.String("val", valStr))
+		showValStr := valStr
+		if name == variable.TiDBCloudStorageURI {
+			showValStr = ast.RedactURL(showValStr)
+		}
+		logutil.BgLogger().Info("set global var", zap.Uint64("conn", sessionVars.ConnectionID), zap.String("name", name), zap.String("val", showValStr))
 		if name == variable.TiDBServiceScope {
 			dom := domain.GetDomain(e.Ctx())
 			serverID := disttaskutil.GenerateSubtaskExecID(ctx, dom.DDL().GetID())
diff --git a/pkg/parser/ast/misc.go b/pkg/parser/ast/misc.go
index 0a7f028482289..0dd9b3efa9665 100644
--- a/pkg/parser/ast/misc.go
+++ b/pkg/parser/ast/misc.go
@@ -800,6 +800,8 @@ const (
 	SetNames = "SetNAMES"
 	// SetCharset is the const for set charset stmt.
 	SetCharset = "SetCharset"
+	// TiDBCloudStorageURI is the const for set tidb_cloud_storage_uri stmt.
+	TiDBCloudStorageURI = "tidb_cloud_storage_uri"
 )
 
 // VariableAssignment is a variable assignment struct.
@@ -838,7 +840,10 @@ func (n *VariableAssignment) Restore(ctx *format.RestoreCtx) error {
 		ctx.WriteName(n.Name)
 		ctx.WritePlain("=")
 	}
-	if err := n.Value.Restore(ctx); err != nil {
+	if n.Name == TiDBCloudStorageURI {
+		// need to redact the url for safety when `show processlist;`
+		ctx.WritePlain(RedactURL(n.Value.(ValueExpr).GetString()))
+	} else if err := n.Value.Restore(ctx); err != nil {
 		return errors.Annotate(err, "An error occurred while restore VariableAssignment.Value")
 	}
 	if n.ExtendValue != nil {
@@ -1109,6 +1114,15 @@ func (n *SetStmt) Accept(v Visitor) (Node, bool) {
 	return v.Leave(n)
 }
 
+// SecureText implements SensitiveStatement interface.
+// need to redact the tidb_cloud_storage_url for safety when `show processlist;`
+func (n *SetStmt) SecureText() string {
+	redactedStmt := *n
+	var sb strings.Builder
+	_ = redactedStmt.Restore(format.NewRestoreCtx(format.DefaultRestoreFlags, &sb))
+	return sb.String()
+}
+
 // SetConfigStmt is the statement to set cluster configs.
 type SetConfigStmt struct {
 	stmtNode