CVE-2026-58139
Received Received - Intake

DuckDB AWS Extension AWS Credential Disclosure

Publication date: 2026-08-03

Last updated on: 2026-08-03

Assigner: VulnCheck

Description
The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-03
Last Modified
2026-08-03
Generated
2026-08-04
AI Q&A
2026-08-03
EPSS Evaluated
N/A
NVD
CVE-2026-58139
EUVD
EUVD-2026-52417

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
duckdb duckdb *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is in the DuckDB AWS extension. It allows any user with SQL execution rights to bypass a security policy and extract plaintext AWS credentials by calling the load_aws_credentials function with redact_secret set to false. This reveals sensitive AWS keys and tokens that can be used to access AWS services.

Detection Guidance

Check for unauthorized access to AWS credentials by monitoring DuckDB logs for calls to the load_aws_credentials function with redact_secret set to false. Review SQL query logs for suspicious function invocations.

Impact Analysis

An attacker with SQL access could steal valid AWS credentials and use them to perform unauthorized actions in your AWS environment. This includes accessing data, launching resources, or incurring costs. The risk is higher in managed setups where AWS credentials are automatically available.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations. Exposure of AWS credentials may result in data breaches, triggering legal penalties and reputational damage.

Mitigation Strategies

Disable the AWS extension in DuckDB if not required. Update to a patched version if available. Restrict SQL execution permissions to trusted users only. Monitor for unauthorized credential access attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58139. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart