CVE-2026-87912: aws aws security agent plugin Unverified Ownership

Vulnerability summary

CVE-2026-87912 is a medium (CVSS 5.9) Unverified Ownership vulnerability in aws aws security agent plugin. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 36.9% of scored vulnerabilities.

Timeline

1. 10-09-2026
   PublishedVulnerability first disclosed.
2. 10-09-2026
   Last modifiedVulnerability information updated.

Description

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 1.1.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

• CWE-283Unverified OwnershipThe product does not properly verify that a critical resource is owned by the proper entity.
• CWE-341Predictable from Observable StateA number or object is predictable based on observations that the attacker can make about the state of the system or network, such as time, process ID, etc.