Security Policy Bypass in DuckDB AWS Extension

CVE-2026-58139

What is CVE-2026-58139?

The DuckDB AWS extension is susceptible to a security policy bypass vulnerability that allows users with SQL execution permissions to extract sensitive AWS credentials. By invoking the load_aws_credentials function with the redact_secret parameter set to false, attackers can bypass the database-wide policy designed to prevent the exposure of unredacted secrets. This vulnerability can lead to the unauthorized retrieval of critical AWS credential information, such as access keys and session tokens, which are highly dangerous in environments where AWS roles and credential chains are in use.

References