Loading story…
Amazon patched a high-severity flaw in Amazon Q Developer and the underlying Language Servers for AWS that allowed a booby-trapped repository to execute attacker-controlled commands when a developer opened and trusted a workspace. Tracked as CVE-2026-12957 and rated CVSS 8.5, the issue involved unsafe handling of Model Context Protocol (MCP) configuration files such as .amazonq/mcp.json, which could cause Amazon Q integrations for VS Code, JetBrains, Eclipse, and Visual Studio to launch local processes defined by an attacker. Those processes inherited the developer’s environment, exposing AWS credentials, API keys, authentication tokens, and SSH agent access already present on the machine.
Wiz Research reported the vulnerability to AWS on April 20, and AWS fixed it on May 12, later publishing an advisory and releasing remediation in Language Servers for AWS 1.65.0. AWS also addressed a related flaw, CVE-2026-12958, involving missing symlink validation that could enable arbitrary file writes outside the workspace trust boundary; customers were advised to upgrade to version 1.69.0 to cover both issues. Researchers said likely attack paths include fake coding tests, typosquatted open-source packages, and malicious pull requests, while noting the weakness reflects broader trust-boundary problems emerging across AI coding assistants that adopt MCP-style workspace configuration.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
Wiz published its write-up describing how a malicious repository containing a .amazonq/mcp.json file could trigger local process execution in Amazon Q Developer and expose AWS credentials, API keys, tokens, and SSH agent access. Reports said no known public exploitation had been observed.
The arbitrary file write vulnerability CVE-2026-12958 was published publicly, with remediation guidance to upgrade Language Servers for AWS to version 1.69.0 or later.
AWS published a security bulletin covering CVE-2026-12957 and the related symlink-handling flaw CVE-2026-12958 affecting Language Servers for AWS and Amazon Q Developer plugins.
Amazon remediated CVE-2026-12957 on May 12, with the fix delivered in Language Servers for AWS version 1.65.0 and propagated to Amazon Q Developer integrations across supported IDEs.
Wiz Research notified AWS about CVE-2026-12957, a high-severity flaw in Amazon Q Developer and Language Servers for AWS that could let a malicious repository execute attacker-controlled commands and expose developer credentials.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
12 references tracked. Mallory keeps watching after this page renders.
darkreading.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcesecurityweek.com
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourceaws.amazon.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers disclosed multiple security flaws affecting AWS MCP components, including a local file inclusion bug in the AWS Remote MCP Server and a critical command injection issue in `aws-mcp-server`. Varonis said authenticated users could abuse AWS CLI shorthand syntax, specifically the `@=` operator passed through the `aws___call_aws` tool, to read arbitrary files from the underlying host even when `FileAccessMode=NO_ACCESS` was enabled. AWS assigned **CVE-2026-4270** to the file access restriction bypass and said the issue was fixed in `aws-api-mcp-server` version **1.3.9**; the exposure affected the public endpoint `aws-mcp.us-east-1.api.aws` as well as self-hosted or forked deployments. A separate flaw, tracked as **CVE-2026-5058** and published by Trend Micro's Zero Day Initiative as **ZDI-26-246**, allows unauthenticated remote code execution in `aws-mcp-server` because user-supplied input in the allowed-commands list is not properly validated before being used in a system call. ZDI rated the bug **CVSS 9.8** and said successful exploitation lets attackers run arbitrary code in the MCP server context; the advisory was released as a 0-day after the vendor rejected the report. The disclosures landed alongside another AWS bulletin for **CVE-2026-4269**, an improper S3 ownership verification issue in the Bedrock AgentCore Starter Toolkit, underscoring broader security concerns around MCP-related tooling and the need for immediate patching and review of derivative implementations.
Jun 29, 2026
AWS published a series of security bulletins covering vulnerabilities across several products and SDKs, including **model artifact integrity verification issues** in the Amazon SageMaker Python SDK (`CVE-2026-8596`, `CVE-2026-8597`), a **heap out-of-bounds read** in `coreMQTT` MQTT5 property parsing (`CVE-2026-8686`), and a **remote code execution** flaw in the `amazon-redshift-python-driver` (`CVE-2026-8838`). The company also disclosed an **arbitrary file read** issue in the `rabbitmq-aws` plugin (`CVE-2026-9133`), **tool execution without authorization via piped stdin** in Kiro CLI (`CVE-2026-9255`), and **insecure deserialization** in Amazon Braket SDK job results processing (`CVE-2026-9291`). A separate advisory addressed **improper authentication token handling** in the Amazon WorkSpaces client for Linux. Taken together, the disclosures span cloud development tools, messaging components, data platforms, quantum-computing SDKs, and end-user clients, indicating a broad patching requirement for organizations using AWS software. Security teams should identify affected packages and clients in their environments and prioritize remediation for flaws that could enable **remote code execution, unauthorized actions, file disclosure, or unsafe processing of untrusted data**.
Jul 12, 2026
Researchers disclosed multiple prompt injection flaws in AWS's Kiro IDE that allowed untrusted content to rewrite the tool's own configuration and execute arbitrary code on a developer's machine. One attack showed that prompt injection hidden in source code comments could modify trusted settings such as `.vscode/settings.json` or add malicious Model Context Protocol servers through `~/.kiro/settings/mcp.json`, effectively allowlisting dangerous Bash commands and triggering local program execution without meaningful user consent. A later finding showed a poisoned web page could similarly induce Kiro to overwrite its MCP configuration, automatically reload it, and launch attacker-defined MCP servers with the developer's privileges. AWS patched the issues in subsequent Kiro releases, including fixes reported in `v0.1.42` and confirmation that the web-based attack no longer worked in `v0.11.130`, while adding protected-path enforcement and a capability-based permissions model; no CVE was assigned to the reported flaws.
Jul 22, 2026