Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
Amazon Q Developer flaw allows malicious repos to run code and steal cloud credentials via MCP configs.
A high-severity vulnerability (CVE-2026-12957, CVSS 8.5) in Amazon Q Developer allowed attackers to execute arbitrary code and exfiltrate AWS credentials through malicious Model Context Protocol (MCP) configuration files in cloned repositories. The flaw affected all four IDE plugins (VS Code, JetBrains, Eclipse, Visual Studio) and required only that a developer open a malicious repo and trust the workspace. Amazon patched the issue by implementing explicit consent prompts before launching untrusted MCP servers; the fix is available in Language Servers for AWS 1.69.0 and later.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Amazon?
Get an email when a new story names Amazon, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA high-severity flaw in Amazon Q Developer's handling of Model Context Protocol (MCP) configuration files allowed attackers to embed malicious configs inside repositories that, once cloned and trusted by a developer, would execute arbitrary code and steal AWS credentials. The root problem was that the IDE plugins automatically launched MCP servers defined in repository configs without requiring explicit user consent, creating a classic supply chain attack vector through developer tooling. This matters because developers routinely clone third-party or unfamiliar repositories, and compromised AWS credentials can lead to catastrophic cloud account takeovers. The attack required minimal user interaction — simply opening a repo and trusting the workspace — making it highly exploitable in normal development workflows.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Security awareness training and phishing simulation
People recognise and report attacks instead of falling for them.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-12957
- cve — CVE-2026-12958