---
id: "CVE-2026-87913"
kind: "vulnerability"
aliases: ["CVE-2026-87913"]
title: "AWS Security Agent MCP server: missing bucket ownership check leaks scan archives"
severity: "medium"
cvss: 5.9
epss: 0.00441
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "aws-agents-for-devsecops", "lab-disclosure", "mcp", "security-agent"]
not_affected_if: ["not-using-security-agent-mcp", "version-0.2.0-or-later"]
published_at: "2026-09-10T16:18:07+00:00"
first_seen_at: "2026-10-24T20:05:35+00:00"
updated_at: "2026-10-25T12:38:49+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/", "first_seen_at": "2026-10-24T20:05:35+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-87913", "first_seen_at": "2026-10-24T20:15:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-87913", "first_seen_at": "2026-10-25T12:38:49+00:00"}]
---

# AWS Security Agent MCP server: missing bucket ownership check leaks scan archives

The AWS Security Agent MCP server before 0.2.0 does not verify that a pre-registered S3 scan-input bucket belongs to the caller's account. An attacker who registers a bucket with the predictable name security-agent-scans-<account identifier> can obtain the private source archive of a scanned workspace, which may include credentials and infrastructure state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of awslabs.security-agent-mcp-server; versions below `0.2.0` are affected, as is `>=0.1.0 AND <=0.1.5`.
- Confirm the bucket `security-agent-scans-` in your AWS account is owned by your own account, as the bulletin advises.

## Fix

- Upgrade awslabs.security-agent-mcp-server to `0.2.0` or later.
- Upgrade agent-toolkit-for-aws to `0.2.0` or later, and patch any forked or derivative code.
- Upgrading does not release a bucket name already registered by a third party, so verify the scan-input bucket is owned by your account.
- Precaution: pre-create the `security-agent-scans-` bucket in your own account before first use.

## Timeline

- 2026-10-24T20:05:35+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/ — AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
- 2026-10-24T20:15:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-87913
- 2026-10-25T12:38:49+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-87913

## Documents

- [advisory] AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/

## From the sources

CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT

Description:

AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.

We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

Impacted versions:

- <=1.0.0
- >=0.1.0 AND <=0.1.5

Resolution:

This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.

References:

- CVE-2026-87912
- CVE-2026-87913
- GHSA-2px6-hhjp-3g5x
- GHSA-3jxw-vj8m-8x77

Acknowledgement:

We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_