AEV-2026-0061
AWS Security Agent plugin uploads scan archives into a bucket it never verified the customer owned (CVE-2026-87912)
The AWS Security Agent plugin, aws-agents-for-devsecops, derived the name of the S3 bucket it uploaded a scanned workspace's source archive to from the customer's own public account id and region, and checked only that a bucket bearing that name existed. An attacker who computed the same name and registered it first, in an account the attacker controlled, received the customer's own subsequent scan uploads, credentials and infrastructure state included. Formally assigned CVE-2026-87912 on 10 September 2026 and fixed in version 1.1.0, which adds bucket ownership verification on every S3 operation.
Affected
- Organisation
- Amazon Web Services (AWS Labs)
- Product
- AWS Security Agent plugin (aws-agents-for-devsecops)
- Component
- The plugin's S3 scan-output upload path, which resolves a destination bucket from the customer's own account id and region
- Versions
- Through version 1.0.0. Corrected in 1.1.0, published 10 September 2026
- Configurations
- The plugin as installed for Claude Code, Codex or Cursor, configured against the customer's own AWS account to upload a scanned workspace's archive to a scan output bucket
Execution authority facts
Fields the evidence does not establish are shown as unknown rather than guessed.
- Intended task
- Upload a scanned workspace's source archive to the customer's own S3 scan output bucket
- Agent
- The AWS Security Agent plugin, acting with the customer's own configured AWS credentials
- Delegating actor
- The customer who installed and ran the plugin against their own AWS account
- Action
- Uploaded a private workspace archive, including files such as .env and private key files and infrastructure state, to an S3 bucket whose name the plugin derived from the customer's own account id and region
- Target resource
- An S3 bucket bearing the derived, predictable name
- Environment
- The customer's own development or CI environment running the plugin, writing to Amazon S3
- Credentials used
- The customer's own AWS credentials configured for the plugin
- Privileges available
- Whatever S3 write access those credentials carried
- Authority presented
- A bucket name derived from the customer's own account id and region, and confirmation that a bucket bearing that name existed and was reachable
- Authority required
- Confirmation that the bucket bearing that name was actually owned by the customer's own AWS account, not merely that it existed
- Applicable policy
- unknown
- Approval mechanism
- none
- Required approver
- unknown
- Independent approval
- no
- Action binding
- The upload was never bound to an explicit, provider enforced ownership assertion, such as S3's own ExpectedBucketOwner condition, at the moment it wrote
- Sequence context
- unknown
Impact
- Consequence
- A private workspace source archive, including credential bearing files and infrastructure state, disclosed to whichever account had pre-registered the predictable bucket name, per the advisory's own stated consequence
- Reach
- organisational
- Reversibility
- irreversible
- Detectability
- silent
- Propagation
- potential
- Recovery
- Fixed in version 1.1.0, confirmed directly by this record to add bucket ownership verification on every S3 operation. AWS's own guidance additionally asks customers to verify their own scan output bucket is actually owned by their own account, since the version upgrade alone does not release a bucket name a third party already registered.
Evidence
Primary sources
- Missing S3 bucket ownership verification in the AWS Security Agent skills for aws-agents-for-devsecops (CVE-2026-87912) (aws/agent-toolkit-for-aws (GitHub Security Advisories))
Supporting sources
- AWS Security Bulletin 2026-105-AWS (Amazon Web Services (Security Bulletins))
- Reproduction status
- Not independently reproduced by Moona Intelligence. This record read the GitHub Security Advisory directly, which states the vendor's own confirmed mechanism and shipped fix, rather than reproducing a bucket pre-registration attack against a live account.
- Evidence state
- Confirmed
Known unknowns
- Whether this vulnerability has been exploited in the wild against any real customer, and how many customers were affected.
- Whether any specific attacker controlled bucket has been identified.
- The exact naming template the plugin used to compose the account id and region into a bucket name.
Limitations
- Direct fetch of AWS's own Security Bulletin 2026-105-AWS was blocked by this session's network egress policy on every attempt; this record relies on the GitHub Security Advisory Database's own record as its primary source instead.
- This session did not clone or independently read the plugin's own source code at the affected version; the mechanism above rests on the advisory's own description rather than an independent code reading.
Claim provenance
- verified
GHSA-2px6-hhjp-3g5x, fetched directly by this session, confirms CVE-2026-87912, the affected and corrected version boundary, the CVSS 4.0 vector, the CWE-283/CWE-341 weakness pair, the missing ownership check mechanism and the credited reporter, Nadav Claude Cohen (glow.io).
The Bucket Existed. AWS Never Checked Who Owned It.