---
id: "GHSA-3jxw-vj8m-8x77"
kind: "vulnerability"
aliases: ["GHSA-3jxw-vj8m-8x77"]
title: "CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: []
ecosystems: []
tags: ["ai-tooling", "aws", "aws-security-agent", "devsecops", "lab-disclosure", "mcp", "s3"]
not_affected_if: ["fixed-version", "not-using-security-agent"]
published_at: null
first_seen_at: "2026-10-24T20:05:36+00:00"
updated_at: "2026-10-25T04:50:11+00:00"
sources: [{"source": "lab", "url": "https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/", "first_seen_at": "2026-10-24T20:05:36+00:00"}]
---

# CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

The AWS Security Agent plugin for aws-agents-for-devsecops (before 1.1.0) and its MCP server (before 0.2.0) do not verify S3 bucket ownership for the scan-input bucket, whose name is derived from a publicly known account ID. An attacker who pre-registers that bucket can obtain the private source archive of a scanned workspace, including credentials and infrastructure state.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed plugin or server version: `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` should both be at `0.2.0` or later; affected are `<=1.0.0` for the plugin and `>=0.1.0 AND <=0.1.5` for the MCP server.
- Verify the scan-input bucket `security-agent-scans-<account identifier>` exists and is owned by your own account.

## Fix

- Upgrade `agent-toolkit-for-aws` and `awslabs.security-agent-mcp-server` to `0.2.0` or later, and patch any forked or derivative code.
- Confirm the scan-input bucket `security-agent-scans-<account identifier>` is owned by your account; upgrading does not release a name already registered by someone else.
- As a precaution, pre-create that bucket in your own account before first use.

## Timeline

- 2026-10-24T20:05:36+00:00 lab https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/ — AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

## Documents

- [advisory] AWS: CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/

## From the sources

CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

### CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

Bulletin ID: 2026-105-AWS Scope: AWS Content Type: Important (requires attention) Publication Date: 09/10/2026 08:30 AM PDT

Description:

AWS Security Agent is a managed AWS service that provides AI-powered code security reviews, threat modeling, and penetration testing.

We identified CVE-2026-87912, where a missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before version 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

We identified CVE-2026-87913, where a missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.

Impacted versions:

- <=1.0.0
- >=0.1.0 AND <=0.1.5

Resolution:

This issues has been addressed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. We recommend upgrading to the latest version and ensuring any forked or derivative code is patched to incorporate the new fixes.

Workarounds:

Upgrading does not release a bucket name that a third party has already registered. We recommend that you verify the scan-input bucket security-agent-scans- - in your account is owned by your own account. As a precaution, you can pre-create that bucket in your own account before first use so that the predictable name cannot be registered by another account.

References:

- CVE-2026-87912
- CVE-2026-87913
- GHSA-2px6-hhjp-3g5x
- GHSA-3jxw-vj8m-8x77

Acknowledgement:

We would like to thank Nadav Claude Cohen from glow.io who reported this issue for collaborating with us through the coordinated vulnerability disclosure process.

 Please email aws-security@amazon.com with any security questions or concerns.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_