{"id":"GHSA-2px6-hhjp-3g5x","kind":"vulnerability","aliases":["GHSA-2px6-hhjp-3g5x"],"related":[],"title":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","description":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scan inputs. An attacker who pre-registers the predictable bucket name security-agent-scans-<account id> can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-security-review","ai-tooling","aws","aws-agents-for-devsecops","lab-disclosure","mcp","security-agent"],"not_affected_if":["bucket-owned-by-own-account","fixed-version"],"how_to_check":"- Check the scan-input bucket `security-agent-scans-<account id>` in your account and confirm your own account owns it.\n- Check the installed `aws-agents-for-devsecops` plugin version, and the `awslabs.security-agent-mcp-server` version; affected if plugin `<=1.0.0` or MCP server `>=0.1.0` and `<=0.1.5`.","fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later.\n- Pre-create the `security-agent-scans-<account id>` bucket in your own account before first use, since upgrading does not release a name another account has already registered.\n- Patch any forked or derivative code to include the fixes.","status":"open","published_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","triaged_at":"2026-10-25T04:50:12+00:00","updated_at":"2026-10-25T04:50:12+00:00","category":"ai-tooling","confidence":0.8,"triage":{"at":"2026-10-25T04:50:12Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later.\n- Pre-create the `security-agent-scans-<account id>` bucket in your own account before first use, since upgrading does not release a name another account has already registered.\n- Patch any forked or derivative code to include the fixes.","reach":"internet","title":"AWS Security Agent plugin: unowned S3 bucket lets attackers take workspace source archives","impact":"high","summary":"The AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scan inputs. An attacker who pre-registers the predictable bucket name security-agent-scans-<account id> can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.","category":"ai-tooling","nicknames":[],"who_cares":["aws","security-agent","mcp","aws-agents-for-devsecops","ai-security-review"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker reads workspace source archives, including credentials and infrastructure state","analyst_note":"","how_to_check":"- Check the scan-input bucket `security-agent-scans-<account id>` in your account and confirm your own account owns it.\n- Check the installed `aws-agents-for-devsecops` plugin version, and the `awslabs.security-agent-mcp-server` version; affected if plugin `<=1.0.0` or MCP server `>=0.1.0` and `<=0.1.5`.","needs_analyst":false,"not_affected_if":["fixed-version","bucket-owned-by-own-account"],"who_is_affected":"Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or the AWS Security Agent MCP server to scan workspaces are exposed when they run an affected version. The risk comes from the predictable bucket name derived from the public account identifier, so a team whose scan-input bucket is already owned by its own account is not exposed to a takeover of that bucket. Teams on the fixed versions still need to confirm the bucket ownership because the upgrade does not release a name already taken.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000819,"input_tokens":4239,"output_tokens":791,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-105':169C '-2026':2A,6A,113C,117C,140C,144C,210C,278C,451C,454C '-87912':3A,114C,141C,211C,452C '-87913':7A,118C,145C,279C,455C '0.1.0':339C '0.1.5':341C '0.2.0':295C,361C '08':181C '09/10/2026':180C '1.0.0':338C '1.1.0':234C '2026':168C '2px6':30A,35A,458C '30':182C '3g5x':32A,37A,460C '3jxw':463C '8x77':465C 'account':273C,334C,414C,420C,434C,448C 'acknowledg':466C 'address':347C 'agent':17A,22A,48B,57B,61B,66B,95B,128C,133C,155C,160C,188C,223C,229C,291C,350C,357C,410C 'agent-mcp-serv':356C 'agent-toolkit-for-aw':349C 'ai':39B,43B,197C 'ai-pow':196C 'ai-security-review':38B 'ai-tool':42B 'allow':236C,297C 'alreadi':396C 'amazon':226C 'anoth':447C 'archiv':102B,244C,257C,305C,318C 'attack':84B,238C,299C 'attent':177C 'aw':15A,21A,45B,47B,59B,65B,126C,132C,153C,159C,170C,172C,186C,192C,221C,228C,289C,353C 'aws-agents-for-devsecop':20A,46B,64B,131C,158C,227C 'aws-security@amazon.com':493C 'awslabs.security':355C 'bucket':10A,77B,91B,121C,148C,216C,264C,284C,325C,389C,407C,430C 'bulletin':166C 'cannot':443C 'claud':473C 'code':199C,375C 'cohen':474C 'collabor':482C 'concern':499C 'contain':254C,315C 'content':173C 'coordin':487C 'creat':428C 'credenti':108B,250C,311C 'cve':1A,5A,112C,116C,139C,143C,209C,277C,450C,453C 'date':179C 'deriv':268C,329C,374C 'descript':185C 'devsecop':24A,50B,68B,135C,162C,231C 'disclosur':53B,489C 'email':492C 'ensur':370C 'first':436C 'fix':382C 'fork':372C 'ghsa':29A,34A,457C,462C 'ghsa-2px6-hhjp-3g5x':28A,33A,456C 'ghsa-3jxw-vj8m-8x77':461C 'glow.io':476C 'hhjp':31A,36A,459C 'id':167C 'identifi':208C,274C,276C,335C 'impact':336C 'import':175C 'includ':107B,249C,310C 'incorpor':379C 'infrastructur':110B,252C,313C 'input':82B,406C 'issu':344C,480C 'known':272C,333C 'lab':52B 'lab-disclosur':51B 'latest':367C 'like':469C 'manag':191C 'mcp':26A,54B,71B,137C,164C,292C,358C 'might':235C,296C 'miss':8A,119C,146C,214C,282C 'model':203C 'nadav':472C 'name':92B,266C,327C,390C,442C 'new':381C 'obtain':98B,240C,301C 'own':416C 'ownership':11A,78B,122C,149C,217C,285C 'parti':394C 'patch':377C 'pdt':184C 'penetr':205C 'pleas':491C 'plugin':18A,62B,129C,156C,224C 'power':198C 'pre':87B,261C,322C,427C 'pre-creat':426C 'pre-regist':86B,260C,321C 'precaut':423C 'predict':90B,441C 'privat':100B,242C,303C 'process':490C 'provid':195C 'public':178C,271C,332C 'question':497C 'recommend':363C,399C 'refer':449C 'regist':88B,262C,323C,397C,445C 'releas':387C 'remot':237C,298C 'report':478C 'requir':176C 'resolut':342C 'review':41B,201C 's3':9A,76B,120C,147C,215C,283C 'scan':81B,96B,105B,247C,308C,405C,411C 'scan-input':404C 'scope':171C 'secur':16A,40B,56B,60B,94B,127C,154C,187C,200C,222C,290C,409C,496C 'security-ag':55B 'security-agent-scan':93B,408C 'server':27A,72B,138C,165C,293C,359C 'servic':193C 'sourc':101B,243C,304C 'state':111B,253C,314C 'storag':263C,324C 'test':206C 'thank':471C 'third':393C 'threat':202C 'tool':44B 'toolkit':351C 'type':174C 'upgrad':364C,384C 'upload':80B 'us':484C 'use':437C 'verif':12A,123C,150C,218C,286C 'verifi':75B,402C 'version':233C,337C,360C,368C 'via':258C,319C 'vj8m':464C 'vulner':488C 'whose':265C,326C 'workaround':383C 'workspac':106B,248C,309C 'would':468C","nicknames":[],"mitigations":[],"who_affected":"Teams that use the AWS Security Agent plugin for aws-agents-for-devsecops or the AWS Security Agent MCP server to scan workspaces are exposed when they run an affected version. The risk comes from the predictable bucket name derived from the public account identifier, so a team whose scan-input bucket is already owned by its own account is not exposed to a takeover of that bucket. Teams on the fixed versions still need to confirm the bucket ownership because the upgrade does not release a name already taken.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":null,"kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"lab","external_id":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/#GHSA-2px6-hhjp-3g5x","url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T20:05:35+00:00","fetched_at":"2026-10-24T20:05:35+00:00","note":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"}],"documents":[{"id":2972,"url":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","title":"AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","kind":"advisory","source":"lab","text":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\n### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server\n\nBulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT\n\nDescription:\n\nAWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.\n\nWe identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nWe identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.\n\nImpacted versions:\n\n- <=1.0.0\n- >=0.1.0 AND <=0.1.5\n\nResolution:\n\nThis issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.\n\nWorkarounds:\n\nUpgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.\n\nReferences:\n\n- CVE-2026-87912\n- CVE-2026-87913\n- GHSA-2px6-hhjp-3g5x\n- GHSA-3jxw-vj8m-8x77\n\nAcknowledgement:\n\nWe would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.\n\n Please email aws-security@amazon.com with any security questions or concerns.","published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}