AWS Security Agent MCP Server CVE-2026-87913 Missing S3 Bucket Ownership Validation

AWS Security Agent MCP Server Vulnerability Summary Vulnerability Overview Vulnerability Name: AWS Security Agent MCP Server lacks S3 bucket ownership verification CVE ID: CVE-2026-87913 CVSS Score: 5.1 (Medium) Vulnerability Type: Write access to an arbitrary third-party S3 bucket (Bucket Ownership not verified) Description: The AWS Security Agent MCP Server uploads the archived scanned workspace source code to an S3 bucket owned by another AWS account, provided the caller's AWS account identifier and region are valid and the bucket name exists. Because the Amazon S3 bucket namespace is global, an attacker (a third party) may have pre-registered the bucket name, thereby gaining access to the target account identifier but not to the target account itself. Scope of Impact Affected Versions: Fixed Version: Affected System: Attack Vector: Network; Attack Complexity: Low; Required Privileges: None; User Interaction: Passive Remediation Upgrade to version 0.2.0 of , which remediates the issue by verifying bucket ownership prior to performing Amazon S3 operations. It is recommended to patch any forks or derived code to incorporate the new fix. Temporary Mitigation (Workaround): - Do not release bucket names already registered by a third party before upgrading. - Verify that the scan input bucket is owned by your own account. - As a preventive measure, pre-create the bucket in your account before first use. POC / Exploit Code No POC code or exploit code blocks are included on the page.

Goal Reached Thanks to every supporter — we hit 100%!

AWS Security Agent MCP Server CVE-2026-87913 Missing S3 Bucket Ownership Validation

More from this source