Live › vulnerability › CVE-2026-87912
Go to dashboardThe AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scanned workspace archives. An attacker who pre-registers the predictable scan-input bucket name, derived from a public account ID, can obtain the private source archive, which may contain credentials and infrastructure state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, on versions covered by the bulletin. Exposure depends on the predictable scan-input bucket name being registered by a third party, which upgrading alone does not prevent, so pre-creating the bucket in your own account is the workaround the bulletin recommends. Teams not running these plugins or the MCP server can skip it.
No product ranges from the sources yet.
agent-toolkit-for-aws or awslabs.security-agent-mcp-server version; the affected versions are plugin <=1.0.0 and MCP server >=0.1.0 AND <=0.1.5security-agent-scans-<account id> exists in your own account and is owned by itagent-toolkit-for-aws and awslabs.security-agent-mcp-server to 0.2.0 or later, and patch any forked or derivative codesecurity-agent-scans-<account id> bucket in your own account before first use so another account cannot register itEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT
Description:
AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.
We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
Impacted versions:
=0.1.0 AND <=0.1.5
Resolution:
This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.
References:
Acknowledgement:
We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-87912")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.