{"id":"CVE-2026-87913","kind":"vulnerability","aliases":["CVE-2026-87913"],"related":[],"title":"AWS Security Agent MCP server: missing bucket ownership check leaks scan archives","description":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Security Agent MCP server before 0.2.0 does not verify that a pre-registered S3 scan-input bucket belongs to the caller's account. An attacker who registers a bucket with the predictable name security-agent-scans-<account identifier> can obtain the private source archive of a scanned workspace, which may include credentials and infrastructure state.","severity":"medium","cvss":5.9,"epss":0.00441,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","aws","aws-agents-for-devsecops","lab-disclosure","mcp","security-agent"],"not_affected_if":["not-using-security-agent-mcp","version-0.2.0-or-later"],"how_to_check":"- Check the installed version of awslabs.security-agent-mcp-server; versions below `0.2.0` are affected, as is `>=0.1.0 AND <=0.1.5`.\n- Confirm the bucket `security-agent-scans-` in your AWS account is owned by your own account, as the bulletin advises.","fix":"- Upgrade awslabs.security-agent-mcp-server to `0.2.0` or later.\n- Upgrade agent-toolkit-for-aws to `0.2.0` or later, and patch any forked or derivative code.\n- Upgrading does not release a bucket name already registered by a third party, so verify the scan-input bucket is owned by your account.\n- Precaution: pre-create the `security-agent-scans-` bucket in your own account before first use.","status":"open","published_at":"2026-09-10T16:18:07+00:00","first_seen_at":"2026-10-24T20:05:35+00:00","triaged_at":"2026-10-25T05:30:17+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"ai-tooling","confidence":0.7,"triage":{"at":"2026-10-25T05:30:17Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade awslabs.security-agent-mcp-server to `0.2.0` or later.\n- Upgrade agent-toolkit-for-aws to `0.2.0` or later, and patch any forked or derivative code.\n- Upgrading does not release a bucket name already registered by a third party, so verify the scan-input bucket is owned by your account.\n- Precaution: pre-create the `security-agent-scans-` bucket in your own account before first use.","reach":"internet","title":"AWS Security Agent MCP server: missing bucket ownership check leaks scan archives","impact":"high","summary":"The AWS Security Agent MCP server before 0.2.0 does not verify that a pre-registered S3 scan-input bucket belongs to the caller's account. An attacker who registers a bucket with the predictable name security-agent-scans-<account identifier> can obtain the private source archive of a scanned workspace, which may include credentials and infrastructure state.","category":"ai-tooling","nicknames":[],"who_cares":["aws","mcp","security-agent","aws-agents-for-devsecops"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads scanned workspace archives, including credentials and infrastructure state","analyst_note":"","how_to_check":"- Check the installed version of awslabs.security-agent-mcp-server; versions below `0.2.0` are affected, as is `>=0.1.0 AND <=0.1.5`.\n- Confirm the bucket `security-agent-scans-` in your AWS account is owned by your own account, as the bulletin advises.","needs_analyst":false,"not_affected_if":["not-using-security-agent-mcp","version-0.2.0-or-later"],"who_is_affected":"Teams that use the AWS Security Agent MCP server or the aws-agents-for-devsecops plugin with scan inputs stored in S3 are exposed. Exposure depends on whether the predictable scan-input bucket name could be registered by another account; teams that do not use the AWS Security Agent MCP server can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000796,"input_tokens":4236,"output_tokens":745,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-105':150C '-2026':14A,17A,94C,98C,121C,125C,191C,259C,432C,435C '-87912':95C,122C,192C,433C '-87913':15A,18A,99C,126C,260C,436C '0.1.0':320C '0.1.5':322C '0.2.0':42B,276C,342C '08':162C '09/10/2026':161C '1.0.0':319C '1.1.0':215C '2026':149C '2px6':439C '30':163C '3g5x':441C '3jxw':444C '8x77':446C 'account':61B,254C,315C,395C,401C,415C,429C 'acknowledg':447C 'address':328C 'agent':3A,25B,34B,38B,74B,109C,114C,136C,141C,169C,204C,210C,272C,331C,338C,391C 'agent-mcp-serv':337C 'agent-toolkit-for-aw':330C 'ai':20B,178C 'ai-pow':177C 'ai-tool':19B 'allow':217C,278C 'alreadi':377C 'amazon':207C 'anoth':428C 'archiv':12A,81B,225C,238C,286C,299C 'attack':63B,219C,280C 'attent':158C 'aw':1A,22B,24B,36B,107C,113C,134C,140C,151C,153C,167C,173C,202C,209C,270C,334C 'aws-agents-for-devsecop':23B,112C,139C,208C 'aws-security@amazon.com':474C 'awslabs.security':336C 'belong':56B 'bucket':7A,55B,67B,102C,129C,197C,245C,265C,306C,370C,388C,411C 'bulletin':147C 'caller':59B 'cannot':424C 'check':9A 'claud':454C 'code':180C,356C 'cohen':455C 'collabor':463C 'concern':480C 'contain':235C,296C 'content':154C 'coordin':468C 'creat':409C 'credenti':89B,231C,292C 'cve':13A,16A,93C,97C,120C,124C,190C,258C,431C,434C 'date':160C 'deriv':249C,310C,355C 'descript':166C 'devsecop':27B,116C,143C,212C 'disclosur':30B,470C 'email':473C 'ensur':351C 'first':417C 'fix':363C 'fork':353C 'ghsa':438C,443C 'ghsa-2px6-hhjp-3g5x':437C 'ghsa-3jxw-vj8m-8x77':442C 'glow.io':457C 'hhjp':440C 'id':148C 'identifi':189C,255C,257C,316C 'impact':317C 'import':156C 'includ':88B,230C,291C 'incorpor':360C 'infrastructur':91B,233C,294C 'input':54B,387C 'issu':325C,461C 'known':253C,314C 'lab':29B 'lab-disclosur':28B 'latest':348C 'leak':10A 'like':450C 'manag':172C 'may':87B 'mcp':4A,31B,39B,118C,145C,273C,339C 'might':216C,277C 'miss':6A,100C,127C,195C,263C 'model':184C 'nadav':453C 'name':71B,247C,308C,371C,423C 'new':362C 'obtain':77B,221C,282C 'own':397C 'ownership':8A,103C,130C,198C,266C 'parti':375C 'patch':358C 'pdt':165C 'penetr':186C 'pleas':472C 'plugin':110C,137C,205C 'power':179C 'pre':49B,242C,303C,408C 'pre-creat':407C 'pre-regist':48B,241C,302C 'precaut':404C 'predict':70B,422C 'privat':79B,223C,284C 'process':471C 'provid':176C 'public':159C,252C,313C 'question':478C 'recommend':344C,380C 'refer':430C 'regist':50B,65B,243C,304C,378C,426C 'releas':368C 'remot':218C,279C 'report':459C 'requir':157C 'resolut':323C 'review':182C 's3':51B,101C,128C,196C,264C 'scan':11A,53B,75B,84B,228C,289C,386C,392C 'scan-input':52B,385C 'scope':152C 'secur':2A,33B,37B,73B,108C,135C,168C,181C,203C,271C,390C,477C 'security-ag':32B 'security-agent-scan':72B,389C 'server':5A,40B,119C,146C,274C,340C 'servic':174C 'sourc':80B,224C,285C 'state':92B,234C,295C 'storag':244C,305C 'test':187C 'thank':452C 'third':374C 'threat':183C 'tool':21B 'toolkit':332C 'type':155C 'upgrad':345C,365C 'us':465C 'use':418C 'verif':104C,131C,199C,267C 'verifi':45B,383C 'version':214C,318C,341C,349C 'via':239C,300C 'vj8m':445C 'vulner':469C 'whose':246C,307C 'workaround':364C 'workspac':85B,229C,290C 'would':449C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the AWS Security Agent MCP server or the aws-agents-for-devsecops plugin with scan inputs stored in S3 are exposed. Exposure depends on whether the predictable scan-input bucket name could be registered by another account; teams that do not use the AWS Security Agent MCP server can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-10T16:18:07+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"ff89ba41-3aa1-4d27-914a-91399e9639e5","poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/#CVE-2026-87913","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","fetched_at":"2026-10-24T20:05:35+00:00","note":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"},{"source":"nvd","external_id":"CVE-2026-87913","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-87913","severity":null,"published_at":"2026-09-10T16:18:07+00:00","modified_at":"2026-09-10T19:54:25+00:00","first_seen_at":"2026-10-24T20:15:27+00:00","fetched_at":"2026-10-24T20:15:27+00:00","note":null},{"source":"epss","external_id":"CVE-2026-87913","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-87913","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[{"id":2972,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","title":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","kind":"advisory","source":"lab","text":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}