{"data":{"id":"58db6491-fd9e-4dc8-a991-199c188b6378","title":"CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server","summary":"CVE-2026-87912 affects the AWS Security Agent plugin in aws-agents-for-devsecops before version 1.1.0, and CVE-2026-87913 affects the AWS Security Agent MCP server before 0.2.0. Both stem from missing S3 bucket ownership verification, which may let remote attackers obtain the private source archive of a scanned workspace, including credentials and infrastructure state, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. Impacted versions are <=1.0.0 and >=0.1.0 AND <=0.1.5.","solution":"Upgrade the aws-agents-for-devsecops plugin to version 1.1.0 or later, and the AWS Security Agent MCP server to version 0.2.0 or later.","labels":["security","industry"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-105-aws/","publishedAt":"2026-09-09T21:30:11.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"high","attackType":["supply_chain","data_extraction"],"issueType":"vulnerability","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS Security Agent","aws-agents-for-devsecops","AWS Security Agent MCP server"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-09-09T21:30:11.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality"],"aiComponentTargeted":"plugin","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0010"],"fixes":[]}}