Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-87912— Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops

Quick assessment

Affected
AWS AWS Security Agent plugin
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是该漏洞描述的中文翻译： 在 Amazon 的 的 AWS 安全代理插件中，由于缺少对 S3 存储桶所有权的验证（版本低于 1.1.0），远程攻击者可能通过一个预先注册的存储桶（其名称由公知的账户标识符推导得出）获取被扫描工作区的私有源存档，该存档中包含凭据和基础设施状态等敏感信息。 修复建议： 1. 用户应升级至 1.1.0 版本以修复此问题。 2. 用户还应核实其账户中的扫描输出存储桶是否归其自有账户所有，因为升级新版本不会释放已被第三方预先注册的存储桶名称。

CVSS 5.9 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-87912

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops
Source: CVE Program / CVE List V5
Vulnerability Description
A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 1.1.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
未经验证的属主
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
AWS AWS Security Agent plugin 1.0.0 -

II. Public POCs for CVE-2026-87912

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-87912

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-87912 (1)

Vendor Advisories for CVE-2026-87912 (2)

IV. Related Vulnerabilities

Same vendor: AWS
Same weakness: CWE-283

V. Comments for CVE-2026-87912

No comments yet

Leave a comment