Aws Security Agent Mcp Server
Monthly
Credential and infrastructure state disclosure in AWS Security Agent MCP Server (versions ≤0.1.5) is enabled by the server's failure to verify S3 bucket ownership before uploading scan archives: an attacker who pre-registers the expected bucket name - derived from the target's publicly known AWS account ID - in their own account will silently receive every subsequent scan archive, which may contain long-lived credentials, Terraform or CloudFormation state files, and other sensitive workspace artifacts. The attack requires no privileges on the victim's account and only passive user interaction (the victim running a scan), but does require the attacker to act before the victim's first deployment. No public exploit has been identified and this CVE is not listed in CISA KEV; vendor-released patch 0.2.0 adds ownership verification, though Amazon explicitly notes that patching alone does not reclaim a bucket name already seized by a third party.
Credential and infrastructure state disclosure in AWS Security Agent MCP Server (versions ≤0.1.5) is enabled by the server's failure to verify S3 bucket ownership before uploading scan archives: an attacker who pre-registers the expected bucket name - derived from the target's publicly known AWS account ID - in their own account will silently receive every subsequent scan archive, which may contain long-lived credentials, Terraform or CloudFormation state files, and other sensitive workspace artifacts. The attack requires no privileges on the victim's account and only passive user interaction (the victim running a scan), but does require the attacker to act before the victim's first deployment. No public exploit has been identified and this CVE is not listed in CISA KEV; vendor-released patch 0.2.0 adds ownership verification, though Amazon explicitly notes that patching alone does not reclaim a bucket name already seized by a third party.