{"data":{"id":"58db6491-fd9e-4dc8-a991-199c188b6378","title":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","summary":"Two vulnerabilities (CVE-2026-87912 and CVE-2026-87913) were found in AWS Security Agent plugins where the system doesn't verify that an S3 bucket (cloud storage container) actually belongs to the account using it. This allows attackers to intercept private source code archives containing sensitive data like credentials and infrastructure information by creating buckets with predictable names based on publicly known account identifiers.","solution":"Update aws-agents-for-devsecops to version 1.1.0 or later, and update AWS Security Agent MCP server to version 0.2.0 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","publishedAt":"2026-09-09T21:30:11.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS","AWS Security Agent","aws-agents-for-devsecops","MCP Server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-09-09T21:30:11.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.92,"researchCategory":null,"atlasIds":null}}