CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server
Amazon S3 ยท 2026-10-25
Actions
Technical Details
| Affected Versions | <=1.0.0, >=0.1.0 AND <=0.1.5 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-87912, CVE-2026-87913 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update AWS Security Agent plugin to version 1.1.0 or later and MCP Server to version 0.2.0 or later to address critical security vulnerabilities and ensure S3 bucket ownership verification.
For Platform Teams
Integrate the latest security patches for AWS Security Agent plugin and MCP Server to enhance platform security and prevent unauthorized access to sensitive data.
For Executives
Implement immediate security patches for AWS Security Agent plugin to mitigate risk of unauthorized access to sensitive data, as outlined in CVE-2026-87912 and CVE-2026-87913.
Source
Related Amazon S3 Updates
- CVE-2026-87912 and CVE-2026-87913: Missing S3 bucket ownership verification in the AWS Security Agent plugin for aws-agents-for-devsecops and MCP Server (2026-10-23)
- AWS Transform adds storage migration assessments for Amazon S3, EBS, EFS, and FSx (2026-10-21)
- Amazon S3 server access log delivery to Amazon CloudWatch Logs now available in five additional AWS Regions (2026-10-21)
- Amazon S3 Metadata now available in six additional AWS Regions (2026-10-15)
- CVE-2026-110310 - RSA PKCS#1 v1.5 padding oracle via legacy envelope key format downgrade in Amazon S3 Encryption Client for .NET (2026-10-14)