CVE-2026-87912

Katalog CVE

CVSS 5.9 · Medium EPSS 0,44%

Kerentanan Unverified Ownership. Skor CVSS 3.1 5.9 (Medium) menurut CNA.

Deskripsi (NVD)

A missing S3 bucket ownership verification in the AWS Security Agent plugin in Amazon aws-agents-for-devsecops before 1.1.0 might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 1.1.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Rincian

Terbit di NVD

10 September 2026

Terakhir diubah

10 September 2026

Status NVD

Awaiting Analysis

CVSS 3.1

5.9 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-283: Unverified Ownership
CWE-341: Predictable from Observable State

EPSS (30 hari)

0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://aws.amazon.com/security/security-bulletins/2026-105-aws/
• https://github.com/aws/agent-toolkit-for-aws/commit/1c0dfd4f677237ee9769769209969ca80b112140
• https://github.com/aws/agent-toolkit-for-aws/security/advisories/GHSA-2px6-hhjp-3g5x