Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

A high-severity flaw in Amazon Q Developer could allow a malicious repository to execute commands and steal a developer’s cloud credentials. The vulnerability, tracked as CVE-2026-12957 (CVSS 8.5), resides in how Amazon’s AI coding assistant handles Model Context Protocol (MCP) servers. Wiz Research discovered and reported the flaw, demonstrating that a single config file dropped in a repository could lead from a git clone to cloud compromise.

The attack works because Amazon Q reads an MCP configuration file (.amazonq/mcp.json) from the open workspace and launches the servers it defines. MCP servers are local processes that an AI assistant can spawn to reach databases, APIs, or build tools, meaning starting one runs commands on the machine. Those processes inherit the developer’s full environment, including AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets. In its proof of concept, Wiz had the file run aws sts get-caller-identity and ship the output to an attacker server, capturing the active AWS session.

The patch closes the gap: Amazon Q now flags an untrusted MCP server and lets the developer reject the command before it runs. The flaw lives in Language Servers for AWS, the runtime that powers Amazon Q across VS Code, JetBrains, Eclipse, and Visual Studio. All four plugins bundle it, so all four were exposed by versions that shipped an older copy. CVE-2026-12957 is fixed in Language Servers for AWS 1.65.0, but AWS recommends moving to 1.69.0, which also closes a second issue, CVE-2026-12958, a missing symlink check that could allow arbitrary file writes outside the workspace trust boundary.

There is no known public exploitation; CISA’s ADP entry for CVE-2026-12957 lists it as none. Wiz found the flaw through research and disclosed it in coordination with Amazon, reporting it on April 20 and seeing a fix on May 12, ahead of the June 26 public write-up. This is part of a pattern where project configuration turns into executable behavior, with similar bugs found in Claude Code (CVE-2025-59536), Cursor (CVE-2025-54136), and Windsurf (CVE-2026-30615).