Executive brief
AWS Security Agent is an AI-powered service that reviews code for security issues and helps with threat modeling and penetration testing. A flaw in the service's S3 storage handling allows attackers to steal private source code, credentials, and cloud infrastructure details from customer workspaces by claiming cloud storage buckets with guessable names. An attacker could expose sensitive business logic, API keys, and infrastructure configurations used by affected customers.
Technical details
The vulnerability stems from missing S3 bucket ownership verification in two AWS Security Agent plugin components. When uploading or accessing workspace archives, neither the aws-agents-for-devsecops plugin (≤1.0.0) nor the MCP Server (≤0.1.5) validate that the caller owns the S3 bucket before storing or retrieving data. An attacker can pre-register an S3 bucket with a name derived from a publicly known AWS account identifier, then intercept PUT/GET requests targeting that bucket. This grants unauthorized access to the complete workspace archive, including source code, environment variables, credentials, and infrastructure-as-code configurations. The attack requires network reachability to AWS S3 and knowledge of target account identifiers, but no authentication against the target account. Patched versions 1.1.0 (aws-agents-for-devsecops) and 0.2.0 (MCP Server) add bucket ownership verification.
Affected products
- AWS aws-agents-for-devsecops before 1.1.0
- AWS AWS Security Agent MCP Server before 0.2.0
CVE identifiers
- CVE-2026-87913
- CVE-2026-87912
Timeline
- 2026-09-10: disclosed: AWS Security Bulletin 2026-105-AWS published