CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server

What it is

AWS bulletin 2026-105-AWS (published 09/10/2026) discloses two S3 bucket-ownership-verification flaws in AWS Security Agent, a managed service for AI code security reviews, threat modeling, and pen testing. CVE-2026-87912 affects the plugin in Amazon aws-agents-for-devsecops; CVE-2026-87913 affects the AWS Security Agent MCP server. Both let a remote attacker obtain the private source archive of a scanned workspace — including credentials and infrastructure state — via a pre-registered bucket whose name derives from a publicly known account identifier.

How it works

The agent writes scan input to a predictably-named bucket, security-agent-scans-<account-id>-<region>. Because the account ID is public and the region enumerable, an attacker can register that exact name in their own account first. The agent does not verify it owns the target bucket, so it writes the victim's source archive into the attacker-controlled bucket.

Preconditions / Affected

The bulletin lists impacted versions as <=1.0.0 and >=0.1.0 AND <=0.1.5. Note these ranges — and the fixed package names — differ from how the item is often described:

• Fixed in agent-toolkit-for-aws and awslabs.security-agent-mcp-server version 0.2.0. (The resolution names the toolkit package, not aws-agents-for-devsecops.)
• Exploitation requires only that the predictable bucket name be unregistered in your account at scan time.

What to do

1. Upgrade to version 0.2.0 of both packages, and patch any forked or derivative code to incorporate the fixes.
2. Verify the scan-input bucket security-agent-scans-<account-id>-<region> in your account is actually owned by your account.
3. As a precaution, pre-create that bucket in your own account before first use so the predictable name cannot be registered by another account.

Caveats

Upgrading is not sufficient on its own. The bulletin states explicitly that upgrading does not release a bucket name a third party has already registered — if the name is already squatted, the patch cannot reclaim it, and you must verify/reclaim ownership manually. This is the ordering trap: the fix stops future writes to an unowned bucket but does nothing about a name an attacker grabbed earlier.