Skip to content
OpenAdvisories

Product · duckdb

duckdb-aws

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.5
    CVE-2026-58139

    DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

    The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load_aws_credentials function with the redact_secret parameter…

    duckdb duckdb-aws