EUVD-2026-52417
GHSA-g2r8-97m7-62w9
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
PR:L for required SQL authentication; C:H for full plaintext credential disclosure; S:U as the DuckDB system scope does not change; I:N and A:N because there is no direct integrity or availability impact on the vulnerable system.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
3DescriptionCVE.org
The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter set to false, circumventing the database-wide allow_unredacted_secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access_key_id, secret_access_key, session_token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg_duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.
AnalysisAI
Plaintext AWS credential extraction in the DuckDB AWS Extension allows any SQL-privileged database user to bypass the database-wide allow_unredacted_secrets=false security policy by invoking load_aws_credentials(redact_secret=false), returning the full AWS credential chain - access_key_id, secret_access_key, session_token, and region - in cleartext. The bypass is particularly impactful in managed cloud environments where pg_duckdb is preloaded and an ambient AWS credential chain (IMDSv2, IRSA, ECS task role, EC2 instance profile) is automatically reachable from the database host, effectively converting low-privilege SQL access into valid cloud API credentials. No public exploit code or CISA KEV listing has been identified; an upstream fix is confirmed via GitHub commit 7d04119 (PR #156), though a tagged patched release version is not confirmed in available data.
Technical ContextAI
DuckDB is an in-process analytical database; its AWS Extension adds native integration with AWS credential chains via the Aws::Auth::DefaultAWSCredentialsProviderChain from the AWS C++ SDK. The extension exposes a load_aws_credentials table function that fetches credentials and optionally surfaces them to the caller. CWE-863 (Incorrect Authorization) applies because the extension implemented a redact_secret parameter with an intent to honor the database-wide allow_unredacted_secrets setting, but the policy check in LoadAWSCredentialsBind was bypassable - callers could pass redact_secret=false and receive full plaintext credentials regardless of the global setting. Additionally, the source code diff reveals that session_token and access_key_id were never redacted even when redact_secret=true (only secret_access_key was conditionally redacted), meaning partial credential leakage occurred in all invocations. The fix (commit 7d04119) removes the entire load_aws_credentials function and the AwsSetCredentialsResult struct rather than attempting to patch the flawed redaction logic. The CVSS 4.0 vector AT:P reflects the specific deployment precondition: an AWS credential chain must be reachable from the host running DuckDB.
RemediationAI
Apply the upstream fix from GitHub commit 7d04119ee8d3f8836e278f0e8cbf21827ff5338b (PR #156 at https://github.com/duckdb/duckdb-aws/pull/156), which removes the load_aws_credentials function entirely. A tagged patched release version is not confirmed in available data - verify the current release tag in the duckdb/duckdb-aws repository to confirm whether a release incorporating this commit has been published. If immediate patching is not possible, restrict SQL execution privileges on the DuckDB or pg_duckdb instance to the minimum required user set, reducing the pool of principals who could invoke load_aws_credentials; note that this does not eliminate the vulnerability, only limits who can trigger it. In managed environments (pg_duckdb on RDS, Aurora, or similar), apply least-privilege IAM policies to the attached instance role or task role so that even if credentials are extracted, their AWS permissions are minimal - this limits blast radius without blocking the extraction itself. Blocking or revoking access to the load_aws_credentials function via DuckDB role-based controls is an additional compensating control where supported.
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today