Executive Lead: Supply Chain Exposure in Autonomous Cloud DevSecOps Agents

Amazon Web Services (AWS) has published security bulletins detailing two closely related vulnerabilities affecting the AWS Security Agent and its companion Model Context Protocol (MCP) server. Designated as CVE-2026-87912 (impacting the aws-agents-for-devsecops plugin) and CVE-2026-87913 (impacting the AWS Security Agent MCP server), both defects carry Common Vulnerability Scoring System (CVSS v3.1) base scores of 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

The vulnerabilities expose enterprise CI/CD pipelines and autonomous developer agent workflows to S3 Bucket Squatting. When an AI DevSecOps agent initiates a vulnerability scan, it automatically packages local repository source trees and uploads them to a designated Amazon S3 staging bucket. Because the agent constructed bucket names following a deterministic, predictable pattern without asserting cryptographic account ownership, an external threat actor could pre-emptively create that bucket in their own AWS account. Once registered, the victim's automated agents unknowingly stream proprietary source code archives, database connection strings, API tokens, and Infrastructure-as-Code (IaC) configurations directly into attacker-controlled storage.

Technical Root Cause & CWE-346 Dissection: Predictable Bucket Naming Without ExpectedBucketOwner

Under CWE-346: Origin Validation Error and CWE-862: Missing Authorization, the vulnerability stems from a fundamental breakdown in S3 tenant isolation assumptions within the AWS Security Agent SDK.

Amazon S3 maintains a globally unique namespace: once a bucket name is registered in any AWS account worldwide, no other account in any AWS region can claim that name. To prevent cross-account bucket hijacking, the AWS SDK for Go, Python (Boto3), and TypeScript provides the ExpectedBucketOwner parameter. When passed in API calls (such as PutObject, GetObject, or HeadBucket), the S3 service verifies that the target bucket belongs strictly to the expected 12-digit AWS account ID, returning an AccessDenied (HTTP 403) error if an account mismatch occurs.

In the affected AWS Security Agent plugin (versions prior to 1.1.0) and MCP server (versions 0.1.0 through 0.1.5), the automated upload routine generated staging bucket names using a deterministic formula:
security-agent-scans-<ACCOUNT_ID>-<REGION> 

// Vulnerable S3 Upload Workflow in AWS Security Agent MCP Server
func UploadSourceArchive(ctx context.Context, s3Client *s3.Client, accountID string, region string, archivePath string) error {
    bucketName := fmt.Sprintf("security-agent-scans-%s-%s", accountID, region)
    file, err := os.Open(archivePath)
    if err != nil {
        return err
    }
    defer file.Close()

    // CRITICAL DEFECT: Calling PutObject without ExpectedBucketOwner parameter!
    // If an external attacker has created this bucket in account 999999999999,
    // the S3 API evaluates permissions against the attacker's public bucket policy.
    _, err = s3Client.PutObject(ctx, &s3.PutObjectInput{
        Bucket: aws.String(bucketName),
        Key:    aws.String(filepath.Base(archivePath)),
        Body:   file,
        // ExpectedBucketOwner: aws.String(accountID), <-- OMITTED IN VULNERABLE RELEASES
    })
    return err
}

Because AWS account IDs are widely exposed in public Git commits, public S3 bucket policies, CloudFront URLs, and container registry paths, adversaries can harvest organization account numbers and systematically register these predictable scan-bucket names across primary regions (e.g., us-east-1, us-west-2, eu-west-1). If the victim account had not already provisioned that bucket, the attacker's squatted bucket became the recipient of all subsequent DevSecOps scan payloads.

Architecture & Attack Trajectory Diagram

The diagram below illustrates how an external adversary intercepts proprietary source code archives via S3 bucket squatting: 

+-----------------------------------------------------------------------------------+
|                        CVE-2026-87912 S3 SQUATTING EXPLOIT FLOW                   |
+-----------------------------------------------------------------------------------+
|                                                                                   |
|  [ Attacker Reconnaissance ]                                                      |
|    - Discovers victim AWS Account ID: 123456789012 from public repo metadata      |
|    - Pre-creates S3 Bucket in Attacker AWS Account (999999999999):                |
|        Name: security-agent-scans-123456789012-us-east-1                          |
|    - Sets Bucket Policy allowing public s3:PutObject                              |
|                                                                                   |
|  [ Victim CI/CD / Developer Workstation ]                                         |
|          |                                                                        |
|          |  1. Developer triggers AI DevSecOps Agent scan                         |
|          v                                                                        |
|  +-----------------------------------------------------------------------------+  |
|  | AWS Security Agent / MCP Server (Vulnerable < v1.1.0 / < v0.2.0)            |  |
|  |                                                                             |  |
|  |   [ Source Packaging Engine ]                                               |  |
|  |          |                                                                  |  |
|  |          |  2. Compresses workspace: source_archive.zip                     |  |
|  |          |     (Contains .git, .env, application source, secrets)           |  |
|  |          v                                                                  |  |
|  |   [ S3 PutObject Request: security-agent-scans-123456789012-us-east-1 ]     |  |
|  |          |                                                                  |  |
|  |          |  FAILED CHECK: Omits ExpectedBucketOwner validation              |  |
|  +----------|------------------------------------------------------------------+  |
|             |                                                                     |
|             v  3. Upload dispatched to AWS S3 global endpoint                     |
|  +-----------------------------------------------------------------------------+  |
|  | Attacker-Owned Amazon S3 Bucket (Account 999999999999)                       |  |
|  |                                                                             |  |
|  |   - Stores: source_archive.zip                                              |  |
|  |   - S3 Event Notification triggers AWS Lambda function                      |  |
|  |   - Automated secret extraction (API keys, SSH keys, database credentials)   |  |
|  +-----------------------------------------------------------------------------+  |
|             |                                                                     |
|             v                                                                     |
|  [ Attacker Pivots to Compromise Enterprise GitHub Repos & Production AWS IAM ]   |
|                                                                                   |
+-----------------------------------------------------------------------------------+

Supply Chain Blast Radius & Enterprise DevSecOps Exposure

The security implications of CVE-2026-87912 and CVE-2026-87913 extend directly to corporate IP and crown-jewel infrastructure:

  • Full Source Code Exfiltration: DevSecOps security agents package entire project trees prior to scanning for vulnerabilities. This includes uncommitted local code changes, internal documentation, architecture specs, and proprietary business logic.
  • Embedded Credential Harvesting: Developers frequently maintain local .env files, configuration secrets, and development certificates that are inadvertently swept into scan packages if .gitignore rules are not properly respected by the agent packager.
  • Infrastructure-as-Code (IaC) Poisoning: For repositories managing Terraform, AWS CDK, or Kubernetes manifests, the archived code reveals VPC subnet IDs, internal peering connections, IAM role ARNs, and security group topologies, equipping adversaries with a complete roadmap for subsequent perimeter penetration.

Defensive Playbook & Remediation Engineering

Cloud security architects, DevSecOps leads, and developers using AWS Security Agents must execute the following remediation protocol immediately:

1. Upgrade AWS Security Agent Components

Update all local and pipeline installations of the agent plugin and MCP server to the patched releases:

Component Vulnerable Versions Patched Release Remediation Fix
AWS Security Agent Plugin < v1.1.0 v1.1.0 or later Enforces ExpectedBucketOwner
AWS Security Agent MCP Server v0.1.0 to v0.1.5 v0.2.0 or later Enforces ExpectedBucketOwner 
# Upgrade AWS Security Agent MCP server via npm
npm install -g @aws/security-agent-mcp-server@latest

# Upgrade DevSecOps agent plugin via pip
pip install --upgrade "aws-agents-for-devsecops>=1.1.0"

2. Pre-Emptive S3 Bucket Provisioning

Upgrading code prevents the agent from writing to non-owned buckets, but if an attacker has already registered your predictable bucket name, your agents will fail with AccessDenied errors. Cloud teams should pre-emptively create and claim the scan buckets across all active regions within their legitimate AWS accounts: 

# Bash Script: Pre-create scan buckets across primary AWS regions
ACCOUNT_ID=$(aws sts get-caller-identity --query Account --output text)
REGIONS=("us-east-1" "us-west-2" "eu-west-1" "ap-southeast-1")

for REGION in "${REGIONS[@]}"; do
  BUCKET_NAME="security-agent-scans-${ACCOUNT_ID}-${REGION}"
  echo "Checking bucket: ${BUCKET_NAME}..."
  
  # Check if bucket exists and is owned by caller
  if aws s3api head-bucket --bucket "${BUCKET_NAME}" --expected-bucket-owner "${ACCOUNT_ID}" 2>/dev/null; then
    echo "Bucket ${BUCKET_NAME} already owned by this account."
  else
    echo "Creating bucket ${BUCKET_NAME} in region ${REGION}..."
    if [ "$REGION" == "us-east-1" ]; then
      aws s3api create-bucket --bucket "${BUCKET_NAME}"
    else
      aws s3api create-bucket --bucket "${BUCKET_NAME}" \
        --create-bucket-configuration LocationConstraint="${REGION}"
    fi
    # Block all public access immediately
    aws s3api put-public-access-block --bucket "${BUCKET_NAME}" \
      --public-access-block-configuration "BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true"
  fi
done

3. AWS CloudTrail Audit & Threat Hunting Query

Defenders should query AWS CloudTrail to verify whether PutObject requests were dispatched to buckets where the recipientAccountId did not match the calling account: 

-- AWS Athena / CloudTrail Lake Query: Detect Cross-Account S3 Scan Uploads
SELECT 
    eventTime,
    userIdentity.arn AS caller_arn,
    userIdentity.accountId AS caller_account,
    recipientAccountId AS bucket_owner_account,
    requestParameters['bucketName'] AS target_bucket,
    requestParameters['key'] AS uploaded_key
FROM cloudtrail_logs
WHERE eventName = 'PutObject'
  AND requestParameters['bucketName'] LIKE 'security-agent-scans-%'
  AND userIdentity.accountId != recipientAccountId
ORDER BY eventTime DESC;