Live › vulnerability › GHSA-2px6-hhjp-3g5x
Go to dashboardThe AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scan inputs. An attacker who pre-registers the predictable bucket name security-agent-scans-<account id> can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC. All times on this page are UTC.
Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or the AWS Security Agent MCP server to scan workspaces are exposed when they run an affected version. The risk comes from the predictable bucket name derived from the public account identifier, so a team whose scan-input bucket is already owned by its own account is not exposed to a takeover of that bucket. Teams on the fixed versions still need to confirm the bucket ownership because the upgrade does not release a name already taken.
No product ranges from the sources yet.
security-agent-scans-<account id> in your account and confirm your own account owns it.aws-agents-for-devsecops plugin version, and the awslabs.security-agent-mcp-server version; affected if plugin <=1.0.0 or MCP server >=0.1.0 and <=0.1.5.agent-toolkit-for-aws and awslabs.security-agent-mcp-server to 0.2.0 or later.security-agent-scans-<account id> bucket in your own account before first use, since upgrading does not release a name another account has already registered.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT
Description:
AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.
We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
Impacted versions:
=0.1.0 AND <=0.1.5
Resolution:
This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.
References:
Acknowledgement:
We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-2px6-hhjp-3g5x")