{"id":"CVE-2026-87912","kind":"vulnerability","aliases":["CVE-2026-87912"],"related":[],"title":"AWS Security Agent plugin: unverified S3 bucket lets attackers take scan archives","description":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scanned workspace archives. An attacker who pre-registers the predictable scan-input bucket name, derived from a public account ID, can obtain the private source archive, which may contain credentials and infrastructure state.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-agents","ai-tooling","aws","aws-security-agent","devsecops","lab-disclosure","mcp"],"not_affected_if":["not-using-security-agent","patched-version"],"how_to_check":"- Confirm the installed `agent-toolkit-for-aws` or `awslabs.security-agent-mcp-server` version; the affected versions are plugin `<=1.0.0` and MCP server `>=0.1.0 AND <=0.1.5`\n- Verify that the scan-input bucket `security-agent-scans-<account id>` exists in your own account and is owned by it\n- Check whether a bucket with that name exists in another account, which the bulletin describes as the attack condition","fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later, and patch any forked or derivative code\n- Pre-create the `security-agent-scans-<account id>` bucket in your own account before first use so another account cannot register it\n- Rotate any credentials that may have been included in scanned workspace archives","status":"open","published_at":"2026-09-10T16:18:07+00:00","first_seen_at":"2026-10-24T20:05:35+00:00","triaged_at":"2026-10-25T05:30:18+00:00","updated_at":"2026-10-25T05:30:18+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T05:30:18Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later, and patch any forked or derivative code\n- Pre-create the `security-agent-scans-<account id>` bucket in your own account before first use so another account cannot register it\n- Rotate any credentials that may have been included in scanned workspace archives","reach":"internet","title":"AWS Security Agent plugin: unverified S3 bucket lets attackers take scan archives","impact":"high","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scanned workspace archives. An attacker who pre-registers the predictable scan-input bucket name, derived from a public account ID, can obtain the private source archive, which may contain credentials and infrastructure state.","category":"ai-tooling","nicknames":[],"who_cares":["aws","aws-security-agent","mcp","devsecops","ai-agents"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads scanned workspace source archives, including credentials and infrastructure state","analyst_note":"","how_to_check":"- Confirm the installed `agent-toolkit-for-aws` or `awslabs.security-agent-mcp-server` version; the affected versions are plugin `<=1.0.0` and MCP server `>=0.1.0 AND <=0.1.5`\n- Verify that the scan-input bucket `security-agent-scans-<account id>` exists in your own account and is owned by it\n- Check whether a bucket with that name exists in another account, which the bulletin describes as the attack condition","needs_analyst":false,"not_affected_if":["not-using-security-agent","patched-version"],"who_is_affected":"Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, on versions covered by the bulletin. Exposure depends on the predictable scan-input bucket name being registered by a third party, which upgrading alone does not prevent, so pre-creating the bucket in your own account is the workaround the bulletin recommends. Teams not running these plugins or the MCP server can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000825,"input_tokens":4240,"output_tokens":802,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105':150C '-2026':14A,17A,94C,98C,121C,125C,191C,259C,432C,435C '-87912':15A,18A,95C,122C,192C,433C '-87913':99C,126C,260C,436C '0.1.0':320C '0.1.5':322C '0.2.0':276C,342C '08':162C '09/10/2026':161C '1.0.0':319C '1.1.0':215C '2026':149C '2px6':439C '30':163C '3g5x':441C '3jxw':444C '8x77':446C 'account':78B,254C,315C,395C,401C,415C,429C 'acknowledg':447C 'address':328C 'agent':3A,21B,29B,38B,43B,109C,114C,136C,141C,169C,204C,210C,272C,331C,338C,391C 'agent-mcp-serv':337C 'agent-toolkit-for-aw':330C 'ai':20B,23B,178C 'ai-ag':19B 'ai-pow':177C 'ai-tool':22B 'allow':217C,278C 'alreadi':377C 'amazon':207C 'anoth':428C 'archiv':12A,60B,85B,225C,238C,286C,299C 'attack':9A,62B,219C,280C 'attent':158C 'aw':1A,25B,27B,36B,42B,107C,113C,134C,140C,151C,153C,167C,173C,202C,209C,270C,334C 'aws-agents-for-devsecop':41B,112C,139C,208C 'aws-security-ag':26B 'aws-security@amazon.com':474C 'awslabs.security':336C 'bucket':7A,54B,72B,102C,129C,197C,245C,265C,306C,370C,388C,411C 'bulletin':147C 'cannot':424C 'claud':454C 'code':180C,356C 'cohen':455C 'collabor':463C 'concern':480C 'contain':88B,235C,296C 'content':154C 'coordin':468C 'creat':409C 'credenti':89B,231C,292C 'cve':13A,16A,93C,97C,120C,124C,190C,258C,431C,434C 'date':160C 'deriv':74B,249C,310C,355C 'descript':166C 'devsecop':30B,45B,116C,143C,212C 'disclosur':33B,470C 'email':473C 'ensur':351C 'first':417C 'fix':363C 'fork':353C 'ghsa':438C,443C 'ghsa-2px6-hhjp-3g5x':437C 'ghsa-3jxw-vj8m-8x77':442C 'glow.io':457C 'hhjp':440C 'id':79B,148C 'identifi':189C,255C,257C,316C 'impact':317C 'import':156C 'includ':230C,291C 'incorpor':360C 'infrastructur':91B,233C,294C 'input':71B,387C 'issu':325C,461C 'known':253C,314C 'lab':32B 'lab-disclosur':31B 'latest':348C 'let':8A 'like':450C 'manag':172C 'may':87B 'mcp':34B,48B,118C,145C,273C,339C 'might':216C,277C 'miss':100C,127C,195C,263C 'model':184C 'nadav':453C 'name':73B,247C,308C,371C,423C 'new':362C 'obtain':81B,221C,282C 'own':397C 'ownership':55B,103C,130C,198C,266C 'parti':375C 'patch':358C 'pdt':165C 'penetr':186C 'pleas':472C 'plugin':4A,39B,110C,137C,205C 'power':179C 'pre':65B,242C,303C,408C 'pre-creat':407C 'pre-regist':64B,241C,302C 'precaut':404C 'predict':68B,422C 'privat':83B,223C,284C 'process':471C 'provid':176C 'public':77B,159C,252C,313C 'question':478C 'recommend':344C,380C 'refer':430C 'regist':66B,243C,304C,378C,426C 'releas':368C 'remot':218C,279C 'report':459C 'requir':157C 'resolut':323C 'review':182C 's3':6A,53B,101C,128C,196C,264C 'scan':11A,58B,70B,228C,289C,386C,392C 'scan-input':69B,385C 'scope':152C 'secur':2A,28B,37B,108C,135C,168C,181C,203C,271C,390C,477C 'security-agent-scan':389C 'server':49B,119C,146C,274C,340C 'servic':174C 'sourc':84B,224C,285C 'state':92B,234C,295C 'storag':244C,305C 'take':10A 'test':187C 'thank':452C 'third':374C 'threat':183C 'tool':24B 'toolkit':332C 'type':155C 'unverifi':5A 'upgrad':345C,365C 'upload':57B 'us':465C 'use':418C 'verif':104C,131C,199C,267C 'verifi':52B,383C 'version':214C,318C,341C,349C 'via':239C,300C 'vj8m':445C 'vulner':469C 'whose':246C,307C 'workaround':364C 'workspac':59B,229C,290C 'would':449C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, on versions covered by the bulletin. Exposure depends on the predictable scan-input bucket name being registered by a third party, which upgrading alone does not prevent, so pre-creating the bucket in your own account is the workaround the bulletin recommends. Teams not running these plugins or the MCP server can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-10T16:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/#CVE-2026-87912","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","fetched_at":"2026-10-24T20:05:35+00:00","note":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"},{"source":"nvd","external_id":"CVE-2026-87912","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87912","severity":null,"published_at":"2026-09-10T16:18:07+00:00","modified_at":"2026-09-10T19:54:25+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null}],"documents":[{"id":2972,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","title":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","kind":"advisory","source":"lab","text":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}