Vulnerabilities · 77 days ago

Repo Opens Became Live Cloud Compromise

A cloned repository was enough to cross the trust boundary here. Amazon Q Developer read MCP settings from the workspace and launched local helper processes before the code was reviewed, so opening a repo could turn into command execution in the developer’s own cloud session, not just a config change inside the IDE.

Wiz says those helpers inherited the full environment on the machine. That exposed AWS credentials, CLI tokens, API secrets, and SSH sockets already present on the workstation. Amazon patched CVE-2026-12957 in Language Servers for AWS 1.65.0, and AWS points customers to 1.69.0 because that build also fixes CVE-2026-12958.

The risk reaches beyond this one extension. Any IDE assistant that auto-loads workspace configs or spawns local tools can turn a trusted repo open into credential theft before the first line of code is reviewed.

CVE-2026-12957

NVD KEV

CVSS 7.8 HIGH: improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. EPSS 0.2% (7th percentile).

Timeline

Jun 29 Reported by Dark Reading
Jun 26 Reported by The Hacker News

Sources

4 sources covering this story

Dark Reading Jun 29
Amazon Q VS Extension Flaw Leads to Cloud Credential Theft
Adversaries could plant a malicious repository that executes arbitrary code and steals cloud credentials, showcasing MCP risk.
The Hacker News Jun 26
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
Amazon patched CVE-2026-12957, a high-severity Amazon Q Developer flaw that let malicious MCP config run commands and steal AWS credentials.
SecurityWeek Jun 26
Amazon Q Flaw Enabled Cloud Credential Theft via Malicious Repositories
AWS has patched the vulnerability and published its own advisory to inform customers about the potential impact.
Wiz Research Jun 26
Amazon Q Vulnerability: Compromise via MCP Auto-Execution | Wiz Blog
Wiz Research found a critical Amazon Q vulnerability that enabled code execution and cloud credential theft through malicious MCP configurations.

Entities

CVE-2026-12957

Part of the PlainSec briefing for 2026-06-30

Editions

Vulnerabilities · 77 days agoRepo Opens Became Live Cloud CompromiseA cloned repository was enough to cross the trust boundary here. Amazon Q Developer read MCP settings from the workspace and launched local helper processes before the code was reviewed, so opening a repo could turn into command execution in the developer’s own cloud session, not just a config change inside the IDE.Wiz says those helpers inherited the full environment on the machine. That exposed AWS credentials, CLI tokens, API secrets, and SSH sockets already present on the workstation. Amazon patched CVE-2026-12957 in Language Servers for AWS 1.65.0, and AWS points customers to 1.69.0 because that build also fixes CVE-2026-12958.The risk reaches beyond this one extension. Any IDE assistant that auto-loads workspace configs or spawns local tools can turn a trusted repo open into credential theft before the first line of code is reviewed.

CVE-2026-12957

NVD KEV

CVSS 7.8 HIGH: improper trust boundary enforcement in Language Servers for AWS before version 1.65.0 on all supported platforms may allow a for arbitrary code execution. EPSS 0.2% (7th percentile).