AWS security-agent-mcp-server EUVD-2026-90975

Exploitation requires the victim to run the diff scan operation of security-agent-mcp-server (before 0.2.0) against a reference value that the attacker can control - i.e., the server must process an attacker-supplied or attacker-influenced 'reference' input, typically when an AI agent feeds it untrusted repository data. Limiting factors that reduce realistic risk: the attack vector is local (AV:L), user/operator interaction is required to trigger the scan (UI:R), and only versions prior to 0.2.0 are affected. No authentication is required (PR:N) once the vulnerable operation is invoked, but the attacker cannot trigger it remotely without the victim performing the diff scan on the crafted input.

CVSS 3.1 base score is 8.2 (High), driven by a scope change (S:C) and High integrity/availability impact (I:H/A:H) from arbitrary file create/overwrite/truncate, with no confidentiality impact (C:N). However, the vector tempers real-world urgency: it is a LOCAL attack vector (AV:L) requiring user interaction (UI:R), meaning this is not a remotely-triggerable, drive-by issue - a victim must actually run the diff scan operation against attacker-controlled input (e.g., via an AI agent consuming untrusted data). PR:N indicates no authentication is needed once the operation is invoked. No EPSS score was provided, so exploitation probability cannot be quantified; the CVE is NOT in CISA KEV and no public exploit code was identified, so this is not confirmed to be actively exploited. SSVC-style read: technical impact is total for integrity/availability within scope, but automatability is low given the required user interaction and local vector. Net: a credible, high-impact flaw worth prompt patching for anyone running this MCP server, but not an emergency-grade mass-exploitation threat absent any EPSS/KEV/POC signal. Note the AV:L designation combined with the 'context-dependent threat actors' language in the description - exploitation realistically depends on the server processing attacker-influenced reference values, which defenders should confirm against their own usage pattern.

An attacker crafts a malicious reference value and gets it in front of a victim's security-agent-mcp-server - for example embedded in a repository or data stream that the victim's AI agent processes. When the victim invokes the diff scan operation on that input, the crafted reference injects extra arguments into the underlying scan command, causing it to write outside the intended workspace and overwrite or truncate arbitrary files on the host. No public exploit code was identified at the time of analysis, and the local vector plus required user interaction (AV:L/UI:R) mean the victim must actively trigger the scan.