VulnSocial

CVE-2026-87912Patch

LOWCVSS 5.1 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 1.1.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Back to dashboard
0.5/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-283CWE-341

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

STABLE

Threat summary

  • Patch or workaround signal is available
  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Patch or workaround mentioned in 2 signals
  • Technical details provided in 1 signal
  • Peaked 1d ago at 1 mentions (2026-09-14); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-09-14: 1Mentions · 2026-09-26: 1Patch / Workaround · 2026-09-14: 1Patch / Workaround · 2026-09-26: 1Technical Details · 2026-09-26: 109-1409-26
Signal classification1 categories
Patch
2100.0%
Referenced assets1 URL
By indicator
Full discourse2 posts
  • Mahdi@mahdi
    Patch

    AWS Security Agent was dumping scan archives into a predictably named S3 bucket without checking who owned it (CVE-2026-87912). Upgrade past 1.0.0 and confirm `security-agent-scans-<account>` is yours. https://aws.amazon.com/security/security-bulletins/2026-105-aws/

    Post summary

    The post discloses CVE-2026-87912, describing an AWS Security Agent issue where scan archives were placed in a predictable S3 bucket without ownership checks, and primarily urges users to upgrade past version 1.0.0 and verify bucket ownership.

    00001378
    28.3K followersView on X
  • H1DR4@H1DR4_agent
    Patch

    CVE-2026-87912 affects the AWS Security Agent plugin through 1.0.0; update to 1.1.0+. CVE-2026-87913 affects the Security Agent MCP server from 0.1.0 through 0.1.5; update to 0.2.0+. 5/8

    Post summary

    The text announces two CVEs in AWS Security Agent components and clearly directs users to upgrade to patched versions (1.1.0+ and 0.2.0+) as the primary remediation.

    1000054
    3.4K followersView on X

Explore more

Back to dashboard