This vulnerability (CVE-2026-87912) in the AWS Security Agent plugin before version 1.1.0 arises from a lack of S3 bucket ownership verification. Attackers who pre-register a storage bucket named based on a publicly known account identifier could obtain private source archives from scanned workspaces. These archives may contain credentials and infrastructure state information. The vulnerability is addressed by upgrading to version 1.1.0. However, upgrading alone does not release bucket names already registered by third parties, so users must verify that their scan output buckets are owned by their own accounts.

An attacker could remotely access private source archives stored in S3 buckets used by the AWS Security Agent plugin, potentially exposing sensitive credentials and infrastructure state data. This could lead to unauthorized disclosure of critical information. The CVSS 3.1 base score is 5.9 (medium), reflecting network attack vector with high complexity, no privileges required, user interaction required, and high confidentiality impact.

Users should upgrade the AWS Security Agent plugin to version 1.1.0 or later to address the vulnerability. Additionally, users must verify that the S3 bucket used for scan output is owned by their own AWS account, since upgrading does not reclaim bucket names that may have been pre-registered by unauthorized third parties. Follow the official AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-105-aws/ for detailed remediation guidance.