Threat database

CVE-2026-87912 is a vulnerability in the AWS Security Agent plugin before version 1.1.0 where missing verification of S3 bucket ownership could allow remote attackers to access private source archives of scanned workspaces. These archives may contain sensitive credentials and infrastructure state. The issue arises from the use of a pre-registered storage bucket named based on a publicly known account identifier. AWS has released version 1.1.0 to address this vulnerability. Users must also verify that their scan output buckets are owned by their own accounts, as upgrading does not reclaim bucket names already registered by third parties.