# CVE-2026-87913: AWS Security Agent MCP server missing S3 bucket ownership verification

Source: https://junglewise.ai/threats/cve-2026-87913-aws-security-agent-mcp-server-missing-s3-bucket-ownership  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-10. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-87913 · Severity: medium · CVSS 5.9 · Published 2026-09-10

AWS Security Agent MCP server is a tool that performs automated code security reviews and penetration testing scans. Due to missing bucket ownership verification, an attacker can pre-register a predictable S3 bucket name and intercept sensitive scan data—including source code, credentials, and infrastructure configuration—uploaded by the service from other AWS accounts. This can lead to complete compromise of scanned applications and infrastructure.

Vendors: [Amazon Web Services](https://junglewise.ai/threats/vendors/amazon-web-services).

## Quick answers

**Is CVE-2026-87913 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-87913 being exploited in the wild.

**How severe is CVE-2026-87913?** Medium severity, with a CVSS score of 5.9, published 10 September 2026.

**Which products and versions are affected?** Amazon Web Services Security Agent MCP server >=0.1.0, <=0.1.5.

**Is there a fix for CVE-2026-87913?** A patch was published on 2026-09-10: Version 0.2.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-87913 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-87913?** Check whether you run Amazon Web Services Security Agent MCP server at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability stems from insufficient S3 bucket ownership validation in the AWS Security Agent MCP server (versions 0.1.0 to 0.1.5). The server derives a scan-input bucket name from the target's AWS account ID and region—both publicly known—and checks only for bucket existence, not ownership. An attacker can pre-register a bucket with this predictable name in their own account and receive uploaded scan archives containing source code, credentials, and infrastructure state. The attack requires only knowledge of the target account ID and region (no access credentials needed). The fix in version 0.2.0 adds ExpectedBucketOwner validation on S3 operations to ensure buckets are account-owned before upload. Exploitation vector is network-based with low complexity and no privilege requirements.

## Affected products

- Amazon Web Services Security Agent MCP server >=0.1.0, <=0.1.5

## Timeline

- 2026-09-10: disclosed
- 2026-09-10: patched: Version 0.2.0 released

## References

- [https://aws.amazon.com/security/security-bulletins/2026-105-aws/](https://aws.amazon.com/security/security-bulletins/2026-105-aws/)
- [https://github.com/awslabs/mcp/security/advisories/GHSA-3jxw-vj8m-8x77](https://github.com/awslabs/mcp/security/advisories/GHSA-3jxw-vj8m-8x77)