Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs (opens in new tab)

Covers 3 stories including CVE-2026-12957 and CVE-2026-12958 - Issues in Language Servers for AWS and Amazon Q Developer PluginsCovered by TNW | Artificial-Intelligence

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon's AI coding assistant handled Model Context Protocol (MCP) servers. Wiz

Read the original article

Sign in to keep reading the full article.

Sign Up Log In

Covered in 1 article

TNW | Artificial-Intelligence·

Covered in 1 article

A single config file in a cloned repository could steal your AWS credentials through Amazon Q Developer