Amazon Q Developer Flaw Let Malicious Repos Execute Code and Steal Cloud Credentials

Amazon patched a high-severity flaw in Amazon Q Developer and the underlying Language Servers for AWS that allowed a booby-trapped repository to execute attacker-controlled commands when a developer opened and trusted a workspace. Tracked as CVE-2026-12957 and rated CVSS 8.5, the issue involved unsafe handling of Model Context Protocol (MCP) configuration files such as .amazonq/mcp.json, which could cause Amazon Q integrations for VS Code, JetBrains, Eclipse, and Visual Studio to launch local processes defined by an attacker. Those processes inherited the developer’s environment, exposing AWS credentials, API keys, authentication tokens, and SSH agent access already present on the machine.

Wiz Research reported the vulnerability to AWS on April 20, and AWS fixed it on May 12, later publishing an advisory and releasing remediation in Language Servers for AWS 1.65.0. AWS also addressed a related flaw, CVE-2026-12958, involving missing symlink validation that could enable arbitrary file writes outside the workspace trust boundary; customers were advised to upgrade to version 1.69.0 to cover both issues. Researchers said likely attack paths include fake coding tests, typosquatted open-source packages, and malicious pull requests, while noting the weakness reflects broader trust-boundary problems emerging across AI coding assistants that adopt MCP-style workspace configuration.