---
id: "GHSA-2px6-hhjp-3g5x"
kind: "vulnerability"
aliases: ["GHSA-2px6-hhjp-3g5x"]
title: "CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-security-review", "ai-tooling", "aws", "aws-agents-for-devsecops", "lab-disclosure", "mcp", "security-agent"]
not_affected_if: ["bucket-owned-by-own-account", "fixed-version"]
published_at: null
first_seen_at: "2026-10-24T20:05:35+00:00"
updated_at: "2026-10-25T04:50:12+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/", "first_seen_at": "2026-10-24T20:05:35+00:00"}]
---

# CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

The AWS Security Agent plugin for aws-agents-for-devsecops and its MCP server do not verify S3 bucket ownership before uploading scan inputs. An attacker who pre-registers the predictable bucket name security-agent-scans-<account id> can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the scan-input bucket `security-agent-scans-<account id>` in your account and confirm your own account owns it.
- Check the installed `aws-agents-for-devsecops` plugin version, and the `awslabs.security-agent-mcp-server` version; affected if plugin `<=1.0.0` or MCP server `>=0.1.0` and `<=0.1.5`.

## Fix

- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later.
- Pre-create the `security-agent-scans-<account id>` bucket in your own account before first use, since upgrading does not release a name another account has already registered.
- Patch any forked or derivative code to include the fixes.

## Timeline

- 2026-10-24T20:05:35+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/ — AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

## Documents

- [advisory] AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/

## From the sources

CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT

Description:

AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.

We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

Impacted versions:

- <=1.0.0
- >=0.1.0 AND <=0.1.5

Resolution:

This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.

References:

- CVE-2026-87912
- CVE-2026-87913
- GHSA-2px6-hhjp-3g5x
- GHSA-3jxw-vj8m-8x77

Acknowledgement:

We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_