Amazon Q Developer CVE Malicious MCP Configs Steal Cloud Credentials

A high-severity vulnerability in Amazon Q Developer could allow malicious repositories to run arbitrary commands and steal a developer’s cloud credentials. The flaw, tracked as CVE-2026-12957 with a CVSS score of 8.5, was disclosed by Wiz Research on June 26, 2026, after Amazon patched it in May.

What Happened: Amazon Q Developer CVE-2026-12957 Enables Cloud Credential Theft

Amazon’s AI coding assistant, Amazon Q Developer, automatically read a project-level Model Context Protocol (MCP) configuration file from cloned repositories. Consequently, a single .amazonq/mcp.json file could trigger command execution with the developer’s full cloud environment inherited. Wiz Research discovered and responsibly disclosed the issue to Amazon on April 20, 2026. Amazon shipped patches on May 12, 2026, and published its advisory on June 26.

The vulnerability affects all four Amazon Q Developer IDE plugins: VS Code, JetBrains, Eclipse, and Visual Studio. Moreover, the underlying Language Servers for AWS runtime powers all four integrations, meaning any developer using Amazon Q across any supported editor was potentially exposed.

Technical Details of the CVE-2026-12957 MCP Exploit

The attack leverages how Amazon Q Developer handled MCP server configuration files within untrusted workspaces. MCP servers are local processes that AI assistants spawn to reach databases, APIs, or build tools. When Amazon Q launched an MCP server from a repository-carried config, that process inherited the developer’s complete environment.

The attack chain works as follows:

• Attacker crafts a malicious repository containing an .amazonq/mcp.json file
• Developer clones the repo and trusts the workspace when prompted
• Amazon Q reads the MCP config and launches the defined server process
• The spawned process inherits AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets
• Malicious code exfiltrates credentials or establishes cloud persistence without additional authentication

In Wiz’s proof of concept, the malicious config ran aws sts get-caller-identity and shipped the output to an attacker-controlled server. This captured the active AWS session immediately. What comes next depends on the compromised developer’s cloud permissions. Attackers could backdoor IAM users, reach internal services, or pivot toward production environments.

Amazon’s advisory frames the consent step as requiring the user to trust the workspace when prompted. CVSS rates this user interaction as passive. However, Wiz reported there was no separate consent step for the MCP servers themselves before the fix. The patch closes this gap. Amazon Q now flags untrusted MCP servers and lets the developer reject the command before execution.

Business and Operational Impact

The vulnerability poses significant risks to organizations using Amazon Q Developer in cloud-native development workflows:

• Cloud credential theft: AWS keys, CLI tokens, and API secrets exfiltrated in seconds
• Production compromise: Stolen credentials may grant access to production environments and sensitive data stores
• Lateral movement: Attackers pivot from a developer workstation to broader cloud infrastructure
• Supply chain propagation: Compromised developer accounts can push malicious code to internal repositories
• Insider threat emulation: Attackers operate with legitimate credentials, evading traditional detection

Furthermore, the vulnerability fits a broader pattern of AI coding assistants mishandling project-level configuration. Similar flaws affected Claude Code (CVE-2025-59536), Cursor (CVE-2025-54136), and Windsurf (CVE-2026-30615). The convenience of letting a project folder configure an AI agent is also the attack surface.

Mitigation and Recommendations

Immediate Actions for Defenders

1. Update Amazon Q Developer plugins immediately. CVE-2026-12957 is fixed in Language Servers for AWS 1.65.0, but AWS recommends upgrading to 1.69.0 to also close CVE-2026-12958.
2. Verify minimum plugin versions. VS Code 2.20+, JetBrains 4.3+, Eclipse 2.7.4+, and Visual Studio toolkit 1.94.0.0+.
3. Audit recent MCP config files. Scan cloned repositories for unexpected .amazonq/mcp.json files.
4. Rotate cloud credentials. If developers may have cloned untrusted repositories, rotate AWS keys and invalidate active sessions.
5. Review IAM permissions. Apply least-privilege policies to developer accounts to limit blast radius.

Long-Term Security Measures

Organizations should treat repository-carried configuration as untrusted input. Therefore, security teams should implement policies that block AI assistants from auto-executing MCP servers without explicit per-server approval. Moreover, consider sandboxing development environments so that IDE plugins cannot access live cloud credentials.

Bottom line: A single config file in a cloned repository could go from git clone to cloud compromise. Update your Amazon Q Developer plugins now and treat every repository-carried MCP configuration as potentially hostile.

Incident Summary

CVE ID / Incident:	CVE-2026-12957
Affected Systems:	Amazon Q Developer (VS Code, JetBrains, Eclipse, Visual Studio plugins via Language Servers for AWS)
Disclosure Date:	June 26, 2026 (patched May 12, 2026)
Patch Status:	Fixed in Language Servers for AWS 1.65.0; upgrade to 1.69.0 recommended
CVSS Score:	8.5 (High severity)
Attack Vector:	Network (requires user to clone and trust malicious repository)
Exploit Complexity:	Low (single config file sufficient)

References

1. Wiz Research, “Amazon Q Developer Vulnerability: Malicious MCP Configs Enable Cloud Credential Theft,” June 26, 2026. https://www.wiz.io/blog/amazon-q-vulnerability (accessed June 26, 2026).
2. Amazon Web Services, “AWS Security Bulletin 2026-047: Language Servers for AWS,” June 26, 2026. https://aws.amazon.com/security/security-bulletins/2026-047-aws/ (accessed June 26, 2026).
3. GitHub Advisory, “GHSA-xhcr-j4j9-3gh7: Language Servers for AWS MCP Trust Boundary Issue,” May 12, 2026. https://github.com/aws/language-servers/security/advisories/GHSA-xhcr-j4j9-3gh7 (accessed June 26, 2026).
4. CVE.org, “CVE-2026-12957 Record,” June 2026. https://www.cve.org/cverecord?id=CVE-2026-12957 (accessed June 26, 2026).
5. The Hacker News, “Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs,” June 26, 2026. https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html (accessed June 26, 2026).