CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Source AWS Security Bulletins
Mentioned vulnerabilities
Not known to be exploited · CVSS 5.9 Medium.
Data as of 10/25/2026, 05:51:09 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 37% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
Until official fixes or mitigations are published by AWS, monitor vendor communications for updates.
Description
CVE-2026-87912 and CVE-2026-87913 refer to missing S3 bucket ownership verification vulnerabilities in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server. The vulnerabilities relate to improper validation of S3 bucket ownership, which could potentially lead to security issues. No specific affected versions or detailed technical information are provided. No known exploits are reported in the wild. No patch or remediation information is available at this time.
Impact
The impact involves potential unauthorized access or misuse of S3 buckets due to missing ownership verification in the affected AWS Security Agent plugin components. Without further details, the exact scope and severity of impact cannot be fully assessed. No active exploitation is known.
Summary
These CVEs identify missing ownership verification checks for S3 buckets within the AWS Security Agent plugin components used in aws-agents-for-devsecops and MCP Server. The lack of verification could allow unauthorized access or manipulation of S3 buckets if exploited. However, detailed technical data, affected versions, and exploit details are not provided in the available information.