Amazon Q Developer Flaw Allows Code Execution and Credential Theft via Malicious Repositories

Amazon Web Services has disclosed critical vulnerabilities, CVE-2026-12957 and CVE-2026-12958, affecting the Amazon Q Developer Extension for various Integrated Development Environments (IDEs) including Visual Studio Code, JetBrains, Eclipse, and Visual Studio. These flaws could enable attackers to execute arbitrary code and exfiltrate sensitive cloud credentials by leveraging malicious code repositories. The primary issue, CVE-2026-12957, involves improper trust boundary enforcement within the Language Servers for AWS, which powers Amazon Q Developer. It was found that the extension would automatically load and execute commands defined in Model Context Protocol (MCP) server configurations (`.amazonq/mcp.json`) present in a workspace, even without explicit user consent. This created a dangerous attack vector where merely cloning and opening a compromised repository could lead to a silent compromise of the developer's environment. The consequence of such an attack is severe: spawned processes inherit the developer's full environment, allowing attackers to gain immediate access to critical assets like AWS credentials (including `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN`), Cloud CLI authentication tokens, API keys, and SSH agent sockets. A proof-of-concept demonstrated that a single malicious `.amazonq/mcp.json` file could exfiltrate active AWS session credentials to an attacker-controlled server without any user interaction or warning. Additionally, CVE-2026-12958 addresses a missing symlink validation issue in Language Servers for AWS. This flaw could allow a local user to open a workspace containing a maliciously crafted symlink that resolves to a file path outside the intended workspace trust boundary, potentially leading to arbitrary file writes on the system. Wiz Research discovered these vulnerabilities and responsibly disclosed them to Amazon on April 20, 2026. Amazon deployed an initial fix on May 12, 2026, with full public disclosure occurring on June 26, 2026, under Security Bulletin 2026-047-AWS. The fix for these issues is included in Language Servers for AWS version 1.69.0 and corresponding Amazon Q Developer plugin releases. Users are strongly advised to update their Amazon Q Developer plugins to the latest versions (VS Code: 2.20+, JetBrains: 4.3+, Eclipse: 2.7.4+, Visual Studio toolkit: 1.94.0.0+). Furthermore, developers should treat unfamiliar or unverified repositories as untrusted, inspect `.amazonq/` directories in cloned repositories for unexpected MCP configurations, and carefully review Amazon Q's new “Untrusted MCP Server” consent prompts before approving execution.