Executive brief
AWS Security Agent MCP server is a tool that performs automated code security reviews and penetration testing scans. Due to missing bucket ownership verification, an attacker can pre-register a predictable S3 bucket name and intercept sensitive scan data—including source code, credentials, and infrastructure configuration—uploaded by the service from other AWS accounts. This can lead to complete compromise of scanned applications and infrastructure.
Technical details
This vulnerability stems from insufficient S3 bucket ownership validation in the AWS Security Agent MCP server (versions 0.1.0 to 0.1.5). The server derives a scan-input bucket name from the target's AWS account ID and region—both publicly known—and checks only for bucket existence, not ownership. An attacker can pre-register a bucket with this predictable name in their own account and receive uploaded scan archives containing source code, credentials, and infrastructure state. The attack requires only knowledge of the target account ID and region (no access credentials needed). The fix in version 0.2.0 adds ExpectedBucketOwner validation on S3 operations to ensure buckets are account-owned before upload. Exploitation vector is network-based with low complexity and no privilege requirements.
Affected products
- Amazon Web Services Security Agent MCP server >=0.1.0, <=0.1.5
Timeline
- 2026-09-10: disclosed
- 2026-09-10: patched: Version 0.2.0 released