CVE-2026-87913

The record

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Affected packages

Related vulnerabilities

• CVE-2026-87912 A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon… CWE-283
• CVE-2026-85781 Unverified ownership of a storage access point in the volume deletion component of the… CWE-283
• CVE-2026-9745 IBM Netezza Software 11.3.0.3 through Interim Fix 002 has operations that are performed… CWE-283
• CVE-2026-54467 On the Trusted Firmware-M (TF-M) 2 through 2.3.0 platform before 00d1b3e, mailbox… CWE-283
• CVE-2026-15599 Unverified ownership vulnerability in TÜBİTAK BİLGEM Software Technologies Research… CWE-283
• CVE-2026-44707 Chatwoot is a customer engagement suite. CWE-283
• CVE-2026-44562 Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely… CWE-283
• CVE-2026-40337 The Sentry kernel is a high security level micro-kernel implementation made for high… CWE-283