CVE-2026-58139: DuckDB AWS Extension Auth Bypass Flaw

CVE-2026-58139 Overview

CVE-2026-58139 is a security policy bypass vulnerability in the DuckDB AWS extension. The flaw allows any database user with SQL execution permissions to extract plaintext AWS credentials. Attackers invoke the load_aws_credentials function with redact_secret=false to circumvent the database-wide allow_unredacted_secrets=false policy.

The function returns the full AWS credential chain including access_key_id, secret_access_key, session_token, and region in cleartext. These credentials are immediately valid against AWS APIs. The vulnerability is classified under CWE-863: Incorrect Authorization.

Critical Impact
Any authenticated SQL user can exfiltrate live AWS credentials from IMDSv2, IRSA, ECS task roles, or EC2 instance roles in managed environments where pg_duckdb is preloaded.

Affected Products

DuckDB AWS extension (duckdb-aws)
Deployments using pg_duckdb with the AWS extension preloaded
Managed database environments exposing AWS credential chains (IMDSv2, IRSA, ECS task role, EC2 instance role)

Discovery Timeline

2026-08-03 - CVE-2026-58139 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-58139

Vulnerability Analysis

The DuckDB AWS extension exposes the load_aws_credentials SQL function to resolve AWS credentials for downstream operations such as S3 access. The function accepts a redact_secret parameter that controls whether returned secret material is masked.

When a database administrator sets the global allow_unredacted_secrets=false policy, the expectation is that no SQL surface can return plaintext secrets. The load_aws_credentials implementation does not honor this policy when redact_secret is explicitly set to false by the caller. Any user with EXECUTE on the function can therefore retrieve the resolved credential chain directly.

In managed platforms that preload pg_duckdb, the process typically runs with access to a cloud credential provider chain. A single SQL call is enough to convert least-privileged SQL access into full AWS API access under whatever IAM role the host process assumes.

Root Cause

The root cause is an incorrect authorization check ([CWE-863]) in the load_aws_credentials procedure. The function evaluates the caller-supplied redact_secret argument in isolation, without consulting the allow_unredacted_secrets database configuration flag. The two controls operate independently instead of the global policy taking precedence.

Attack Vector

An authenticated attacker with SQL execution privileges issues a call similar to SELECT * FROM load_aws_credentials(redact_secret => false);. The function resolves credentials via the standard AWS credential chain and returns them as columns in the result set. The attacker then uses the harvested access_key_id, secret_access_key, and session_token against AWS APIs from any network location the STS credentials permit.

text

// Security patch in src/include/aws_extension.hpp
// Removes the AwsSetCredentialsResult struct that exposed plaintext credentials
 namespace duckdb {
 
-struct AwsSetCredentialsResult {
-	string set_access_key_id;
-	string set_secret_access_key;
-	string set_session_token;
-	string set_region;
-};
-
 class AwsExtension : public Extension {
 public:
 	void Load(ExtensionLoader &db) override;

Source: GitHub Commit 7d04119. The fix removes the plaintext credential result structure entirely, deleting the load_aws_credentials function surface rather than patching the redaction logic.

Detection Methods for CVE-2026-58139

Indicators of Compromise

SQL query logs containing calls to load_aws_credentials with the redact_secret argument set to false.
AWS CloudTrail events showing API calls from IAM principals (instance role, IRSA, ECS task role) originating from unexpected source IPs or user agents shortly after DuckDB query activity.
STS GetCallerIdentity calls followed by broad enumeration APIs (s3:ListBuckets, iam:ListUsers) using credentials tied to a database host role.

Detection Strategies

Enable query logging on DuckDB and pg_duckdb deployments and alert on any reference to load_aws_credentials regardless of arguments.
Correlate database query telemetry with AWS CloudTrail to detect use of host-bound credentials from principals other than the database workload itself.
Baseline the expected AWS API call patterns for the database service role and alert on deviations such as credential reuse from external IPs.

Monitoring Recommendations

Ingest DuckDB and PostgreSQL logs into a centralized SIEM for real-time inspection of extension function invocations.
Monitor IMDSv2 access counts on EC2 hosts running pg_duckdb; sudden increases can indicate credential harvesting.
Track IAM Access Analyzer findings for credentials assumed by database workloads being used outside their expected VPC or region.

How to Mitigate CVE-2026-58139

Immediate Actions Required

Upgrade the DuckDB AWS extension to a version that includes the fix from Pull Request #156, which removes the load_aws_credentials function.
Revoke and rotate any AWS credentials that may have been reachable from an exposed pg_duckdb or DuckDB AWS deployment.
Audit SQL query history for prior invocations of load_aws_credentials and treat any hits as a potential credential compromise.

Patch Information

The fix is delivered in the DuckDB AWS commit 7d04119, which removes the AwsSetCredentialsResult structure and the associated load_aws_credentials procedure. Additional context is available in the VulnCheck Security Advisory.

Workarounds

Restrict EXECUTE privileges on the DuckDB AWS extension functions so untrusted database roles cannot call load_aws_credentials.
Scope the IAM role attached to the database host to the minimum permissions required, reducing the blast radius of credential theft.
Block IMDSv2 access from the database process using network policy or hop-limit controls where the extension does not require instance credentials.

bash

# Revoke execution rights on the vulnerable function until patched
REVOKE EXECUTE ON FUNCTION load_aws_credentials FROM PUBLIC;

# Enforce IMDSv2 hop limit to reduce credential exposure on EC2 hosts
aws ec2 modify-instance-metadata-options \
  --instance-id i-0123456789abcdef0 \
  --http-tokens required \
  --http-put-response-hop-limit 1