EUVD-2026-75571Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:N/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Bucket pre-registration race requires attacker to act first (AC:H); victim must run scan (UI:R); scope changes to attacker's bucket (S:C/C:H); no impact to vulnerable system itself.
Primary rating from Vendor (AMZN).
CVSS VectorVendor: AMZN
Lifecycle Timeline
2DescriptionCVE.org
A missing S3 bucket ownership verification in the AWS Security Agent MCP server before 0.2.0 version might allow remote attackers to obtain the private source archive of a scanned workspace, including credentials and infrastructure state contained in that archive, via a pre-registered storage bucket whose name is derived from a publicly known account identifier.
To remediate this issue, users should upgrade to version 0.2.0. Users should also verify that the scan output bucket in their account is owned by their own account, because upgrading does not release a bucket name that a third party has already registered.
AnalysisAI
Credential and infrastructure state disclosure in AWS Security Agent MCP Server (versions ≤0.1.5) is enabled by the server's failure to verify S3 bucket ownership before uploading scan archives: an attacker who pre-registers the expected bucket name - derived from the target's publicly known AWS account ID - in their own account will silently receive every subsequent scan archive, which may contain long-lived credentials, Terraform or CloudFormation state files, and other sensitive workspace artifacts. The attack requires no privileges on the victim's account and only passive user interaction (the victim running a scan), but does require the attacker to act before the victim's first deployment. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires three concrete conditions to align: (1) the attacker must obtain or derive the target organization's AWS account ID from a publicly visible source (S3 ARNs, public GitHub repos, shared CloudFormation outputs) before the victim has run any scan; (2) the expected scan-output bucket name must not yet be registered in any AWS account, meaning only first-time deployments or previously unused regions are at risk; and (3) the victim must execute at least one workspace security scan after the attacker's bucket pre-registration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.1 (AV:N/AC:L/AT:P/PR:N/UI:P/SC:H/SI:L) reflects a medium-severity finding where the high subsequent-system confidentiality impact (SC:H) is tempered by two meaningful prerequisites: the AT:P condition (bucket must be pre-registered before the victim's first scan) and passive user interaction (UI:P, the victim must execute a scan). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade awslabs.security-agent-mcp-server to version 0.2.0 or later, available on PyPI at https://pypi.org/project/awslabs.security-agent-mcp-server/0.2.0/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Unauthorized data access in Budibase low-code platform before 3.30.4 allows unauthenticated users to manipulate internal
Multiple vulnerabilities in ASTPP 4.0.1 including XSS and command injection in SIP device configuration and plugin manag
Remote code execution in Amazon awslabs postgres-mcp-server before 1.1.7 lets remote actors run arbitrary OS commands on
Remote code execution in AWS AgentCore CLI before v0.14.2 allows authenticated attackers to inject Python code via craft
Denial of service in Amazon's aws-smithy-http-server Rust crate (versions prior to 0.66.5) lets remote unauthenticated a
Argument injection in the AWS Bedrock AgentCore Python SDK before 1.18.1 lets a remote authenticated user run arbitrary
Arbitrary file read in amazon-mq rabbitmq-aws before 0.2.1 allows authenticated remote users to read any file accessible
WAF managed-rule body inspection on AWS Application Load Balancer (ALB) can be bypassed by remote actors who fragment an
WAF inspection bypass in Amazon CloudFront (with AWS WAF enabled) lets remote actors smuggle malicious request bodies pa
A trust boundary enforcement vulnerability in Kiro IDE allows remote attackers to execute arbitrary code when a local us
Bullwark Momentum Series JAWS 1.0 contains a directory traversal vulnerability that allows unauthenticated attackers to
Command injection in Amazon ECS Agent on Windows allows authenticated attackers with task definition permissions to exec
Same weakness CWE-283 – Unverified Ownership
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today