Live › vulnerability › GHSA-3jxw-vj8m-8x77
Go to dashboardThe AWS Security Agent plugin for aws-agents-for-devsecops (before 1.1.0) and its MCP server (before 0.2.0) do not verify S3 bucket ownership for the scan-input bucket, whose name is derived from a publicly known account ID. An attacker who pre-registers that bucket can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 20:05 UTC. All times on this page are UTC.
Teams that run the AWS Security Agent plugin for aws-agents-for-devsecops or its MCP server to scan workspaces, since scanned source archives are uploaded to a predictable S3 bucket. Exposure depends on the bucket name being registered by another account, so teams on the fixed versions still need to verify bucket ownership. unknown for teams that do not use these components.
No product ranges from the sources yet.
agent-toolkit-for-aws and awslabs.security-agent-mcp-server should both be at 0.2.0 or later; affected are <=1.0.0 for the plugin and >=0.1.0 AND <=0.1.5 for the MCP server.security-agent-scans-<account identifier> exists and is owned by your own account.agent-toolkit-for-aws and awslabs.security-agent-mcp-server to 0.2.0 or later, and patch any forked or derivative code.security-agent-scans-<account identifier> is owned by your account; upgrading does not release a name already registered by someone else.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT
Description:
AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.
We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
Impacted versions:
=0.1.0 AND <=0.1.5
Resolution:
This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.
Workarounds:
Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.
References:
Acknowledgement:
We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.
Please email [email protected] with any security questions or concerns.
This page as .md · .json · in your agent: get_signal("GHSA-3jxw-vj8m-8x77")