CVE-2026-58139

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-58139

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58139.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-58139

Published

2026-08-03T19:45:31.730Z

Modified

2026-08-15T04:07:09.748254129Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

Details

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the loadawscredentials function with the redactsecret parameter set to false, circumventing the database-wide allowunredactedsecrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including accesskeyid, secretaccesskey, sessiontoken, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

Database specific

{
    "cwe_ids": [
        "CWE-863"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58139.json",
    "cna_assigner": "VulnCheck",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "7d04119ee8d3f8836e278f0e8cbf21827ff5338b"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/duckdb/duckdb-aws

Affected ranges

Type

GIT

Repo

https://github.com/duckdb/duckdb-aws

Events

Introduced

Fixed

7d04119ee8d3f8836e278f0e8cbf21827ff5338b

Database specific

Show details

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58139.json"