Live › vulnerability › CVE-2026-87913
Go to dashboardThe AWS Security Agent MCP server before 0.2.0 does not verify that a pre-registered S3 scan-input bucket belongs to the caller's account. An attacker who registers a bucket with the predictable name security-agent-scans-<account identifier> can obtain the private source archive of a scanned workspace, which may include credentials and infrastructure state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC, 0h before NVD. All times on this page are UTC.
Teams that use the AWS Security Agent MCP server or the aws-agents-for-devsecops plugin with scan inputs stored in S3 are exposed. Exposure depends on whether the predictable scan-input bucket name could be registered by another account; teams that do not use the AWS Security Agent MCP server can skip it.
No product ranges from the sources yet.
0.2.0 are affected, as is >=0.1.0 AND <=0.1.5.security-agent-scans- in your AWS account is owned by your own account, as the bulletin advises.0.2.0 or later.0.2.0 or later, and patch any forked or derivative code.security-agent-scans- bucket in your own account before first use.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT
Description:
AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.
We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
Impacted versions:
=0.1.0 AND <=0.1.5
Resolution:
This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.
References:
Acknowledgement:
We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("CVE-2026-87913")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.