CVE-2026-58139: DuckDB AWS Extension Security Policy Bypass via load_aws_credentials Procedure

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the loadawscredentials function with the redactsecret parameter set to false, circumventing the database-wide allowunredactedsecrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including accesskeyid, secretaccesskey, sessiontoken, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pgduckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.