Cloudanix VulnDB

CVE-2026-58139

Medium · 6.5

CVSS

6.5

EPSS

0.5%

Published

Aug 3, 2026

CISA due date

—

The record

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities