CVE-2026-87913 in Security Agent MCP Server
Summary
by MITRE • 09/10/2026
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/10/2026
The AWS Security Agent MCP server prior to version 0.2.0 contains a critical access control flaw related to Amazon S3 bucket ownership verification. This vulnerability stems from the application's failure to validate whether an incoming request targets an S3 bucket that is legitimately owned by the requesting account or workspace owner. Instead of enforcing strict ownership checks, the system relies on naming conventions where bucket names are derived from publicly known AWS account identifiers. Because these identifiers and resulting bucket names can be enumerated by external actors, a remote attacker with knowledge of a target's account ID can predictively construct valid S3 object keys to access sensitive data stored within those buckets.
The operational impact of this vulnerability is severe, as it allows unauthorized parties to retrieve the private source archive associated with a scanned workspace. These archives typically contain comprehensive infrastructure state information and potentially hardcoded credentials or configuration secrets that were ingested during security scans. By exploiting the missing ownership verification, an attacker can bypass authentication mechanisms intended to restrict access to these artifacts, leading to a significant compromise of confidentiality for cloud environments relying on this agent version. This aligns with CWE-284 Improper Access Control and represents a classic case of insecure direct object reference where predictable identifiers facilitate unauthorized data retrieval.
From a threat modeling perspective using the MITRE ATT&CK framework, this vulnerability facilitates Initial Access through valid accounts or credentials if combined with other factors, but more directly it enables Data Exfiltration via Cloud Storage APIs (T1530). The attacker leverages publicly available information to locate sensitive resources and extracts them without proper authorization checks. This scenario highlights the risks associated with predictable resource naming schemes in cloud environments, where metadata such as account IDs can be used to map internal infrastructure layouts and identify high-value targets for further exploitation or data theft.
To remediate this issue, organizations must upgrade the AWS Security Agent MCP server to version 0.2.0 or later, which implements proper ownership verification logic before serving content from S3 buckets. However, upgrading alone is insufficient if a malicious actor has already registered an S3 bucket with a name derived from the victim's account identifier prior to the patch deployment. Therefore, it is imperative that administrators manually verify the ownership of all scan output buckets within their AWS accounts. If any such buckets are found to be owned by third parties or external entities, they must be transferred back to the correct owner or deleted and recreated under proper access controls to ensure complete mitigation against this specific attack vector.