[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fRLV7J8-2337J6rgiRu9eOV60M-BbQoUVOoTvK4T4aiI":3},{"article":4,"iocs":56,"watch_terms":64,"solutions":65,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"02eae163-571d-4166-9e20-62057ff41031","Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs","amazon-q-developer-flaw-could-let-malicious-repos-run-code-via-mcp-configs-1fc5c8","A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon's AI coding assistant handled Model Context Protocol (MCP) servers. Wiz","A high-severity vulnerability (CVE-2026-12957, CVSS 8.5) in Amazon Q Developer allowed attackers to execute arbitrary code and exfiltrate AWS credentials through malicious Model Context Protocol (MCP) configuration files in cloned repositories. The flaw affected all four IDE plugins (VS Code, JetBrains, Eclipse, Visual Studio) and required only that a developer open a malicious repo and trust the workspace. Amazon patched the issue by implementing explicit consent prompts before launching untrusted MCP servers; the fix is available in Language Servers for AWS 1.69.0 and later.","Amazon Q Developer flaw allows malicious repos to run code and steal cloud credentials via MCP configs.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Famazon-q-developer-flaw-could-let.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEig3gygt20RdznayWN2yru6wSgNt8CSdr16F8I-naxtPn837cr6v0uV0bXdhz36P1XYrpnjmzDXTAtH0wa43Me8rqD2hvET-xQP0ndoX-ddXsypZCjSSNJUqmfl69g96R6yMiUqgXE_NGAL8bl2z6lYutrgKiY74tNIafz_xRsNsJQSB9s_9lSHiybX2kQ\u002Fs1600\u002Faws.jpg","2026-06-26T13:53:00+00:00","2026-06-26T16:00:28.325865+00:00",9,[17,20,23,25,28],{"name":18,"type":19},"Amazon","vendor",{"name":21,"type":22},"Amazon Q Developer","product",{"name":24,"type":22},"Language Servers for AWS",{"name":26,"type":27},"Model Context Protocol (MCP)","technology",{"name":29,"type":19},"Wiz Research","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,51],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":52},{"id":53,"icon":32,"name":54,"slug":55},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[57,61],{"type":58,"value":59,"context":60},"cve","CVE-2026-12957","High-severity flaw in Amazon Q Developer allowing arbitrary code execution and credential theft via malicious MCP config files",{"type":58,"value":62,"context":63},"CVE-2026-12958","Missing symlink check in Language Servers for AWS allowing arbitrary file writes outside workspace trust boundary",[18,29,21],{"controls":66,"vendors":150},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":97,"name":98,"problem":99,"products":100},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"slug":126,"name":127,"problem":128,"products":129},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[130,136,143],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":131,"product_name":132,"url":134,"description":135},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":137,"product_name":140,"url":141,"description":142},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",{"vendor_slug":144,"vendor_name":145,"vendor_logo":146,"product_slug":126,"product_name":147,"url":148,"description":149},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",[151],{"slug":152,"name":153,"logo_path":154,"roles":155},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":172},"malicious-repo-configs-could-execute-code-via-amazon-q-developer-flaw","Malicious Repo Configs Could Execute Code via Amazon Q Developer Flaw","A high-severity flaw in Amazon Q Developer's handling of Model Context Protocol (MCP) configuration files allowed attackers to embed malicious configs inside repositories that, once cloned and trusted by a developer, would execute arbitrary code and steal AWS credentials. The root problem was that the IDE plugins automatically launched MCP servers defined in repository configs without requiring explicit user consent, creating a classic supply chain attack vector through developer tooling. This matters because developers routinely clone third-party or unfamiliar repositories, and compromised AWS credentials can lead to catastrophic cloud account takeovers. The attack required minimal user interaction — simply opening a repo and trusting the workspace — making it highly exploitable in normal development workflows.",[162,163,164,165,166,167,168,169,170,171],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 7: Continuous Vulnerability Management","CIS Control 16: Application Software Security","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF ID.SC-3: Supply Chain Risk Management","NIST CSF PR.IP-12: Vulnerability Management Plan","SLSA Supply Chain Levels for Software Artifacts — Source Integrity",{}]