CVE-2026-87913 — Katalog CVE

csirt@kutim:~/threat-intel/cve/CVE-2026-87913

CVSS 5.9 · Medium EPSS 0,44%

Kerentanan Unverified Ownership. Skor CVSS 3.1 5.9 (Medium) menurut CNA.

Deskripsi (NVD)

A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier. To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.

Rincian

Terbit di NVD: 10 September 2026
Terakhir diubah: 10 September 2026
Status NVD: Awaiting Analysis
CVSS 3.1: 5.9 (Medium), sumber CNA
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:L/A:N · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-283: Unverified Ownership
CWE-341: Predictable from Observable State
EPSS (30 hari): 0,44% peluang dieksploitasi; lebih tinggi dari 36,5% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.