AEV-2026-0062
AWS Security Agent MCP server uploads scan archives into a bucket it never verified the customer owned (CVE-2026-87913)
The AWS Security Agent MCP server, awslabs.security-agent-mcp-server, derived the same predictable S3 bucket name from a customer's own account id and region as its companion plugin, and checked only that the bucket existed, not that the customer's account owned it. Formally assigned CVE-2026-87913 on the same day as the plugin's own CVE-2026-87912, and fixed in version 0.2.0, which implements ExpectedBucketOwner parameter validation and treats a foreign owned bucket as a fatal error.
Affected
- Organisation
- Amazon Web Services (AWS Labs)
- Product
- AWS Security Agent MCP server (awslabs.security-agent-mcp-server)
- Component
- The MCP server's S3 scan-output upload path, which resolves a destination bucket from a caller supplied account id and region
- Versions
- 0.1.0 through 0.1.5. Corrected in 0.2.0, published 10 September 2026
- Configurations
- The MCP server configured against a customer's own AWS account and invoked as a tool by an MCP client or agent to upload a scanned workspace's archive to a scan output bucket
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Upload a scanned workspace's source archive to the customer's own S3 scan output bucket, invoked as a tool call by an MCP client or agent
- Agent
- The AWS Security Agent MCP server, acting with the operator's own configured AWS credentials when its upload tool is called
- Delegating actor
- The operator who configured the MCP server against their own AWS account, and the calling agent or client that invoked its upload tool
- Action
- Uploaded a private workspace archive, including credentials and infrastructure data, to an S3 bucket whose name the server derived from the caller's own account id and region
- Target resource
- An S3 bucket bearing the derived, predictable name
- Environment
- The operator's own environment running the MCP server, writing to Amazon S3
- Credentials used
- The operator's own AWS credentials configured for the MCP server
- Privileges available
- Whatever S3 write access those credentials carried
- Authority presented
- A bucket name derived from the caller's own account id and region, and confirmation that a bucket bearing that name existed and was reachable
- Authority required
- Confirmation that the bucket bearing that name was actually owned by the operator's own AWS account, not merely that it existed
- Applicable policy
- unknown
- Approval mechanism
- none
- Required approver
- unknown
- Independent approval
- no
- Action binding
- The upload was never bound to an explicit, provider enforced ownership assertion at the moment it wrote, before the fix added ExpectedBucketOwner parameter validation
- Sequence context
- unknown
Impact
- Consequence
- A private workspace source archive, including credentials and infrastructure data, disclosed to whichever account had pre-registered the predictable bucket name, needing only the target's public account identifier, per the advisory's own stated consequence
- Reach
- organisational
- Reversibility
- irreversible
- Detectability
- silent
- Propagation
- potential
- Recovery
- Fixed in version 0.2.0, confirmed directly by this record to implement ExpectedBucketOwner parameter validation and enforce ownership checks before upload, treating a foreign owned bucket as a fatal error. AWS's own guidance additionally asks customers to verify their own scan output bucket is actually owned by their own account, since the version upgrade alone does not release a bucket name a third party already registered.
Evidence
Primary sources
- Missing S3 bucket ownership verification in the AWS Security Agent MCP server (CVE-2026-87913) (awslabs/mcp (GitHub Security Advisories))
Supporting sources
- AWS Security Bulletin 2026-105-AWS (Amazon Web Services (Security Bulletins))
- Reproduction status
- Not independently reproduced by Moona Intelligence. This record read the GitHub Security Advisory directly, which states the vendor's own confirmed mechanism and shipped fix, rather than reproducing a bucket pre-registration attack against a live account.
- Evidence state
- Confirmed
Known unknowns
- Whether this vulnerability has been exploited in the wild against any real deployment, and how many operators were affected.
- Whether any specific attacker controlled bucket has been identified.
- Whether an MCP client typically surfaces the destination bucket to a calling agent before the upload proceeds.
Limitations
- Direct fetch of AWS's own Security Bulletin 2026-105-AWS was blocked by this session's network egress policy on every attempt; this record relies on the GitHub Security Advisory Database's own record as its primary source instead.
- This session did not clone or independently read the MCP server's own source code at the affected version; the mechanism above rests on the advisory's own description rather than an independent code reading.
Claim provenance
- verified
GHSA-3jxw-vj8m-8x77, fetched directly by this session, confirms CVE-2026-87913, the affected and corrected version boundary, the CVSS 4.0 vector, the CWE-283/CWE-341 weakness pair, the ExpectedBucketOwner remediation mechanism and the credited reporter, Nadav Claude Cohen (glow.io), the same reporter credited on the companion plugin advisory.
The Bucket Existed. AWS Never Checked Who Owned It.