Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

Amazon Q Developer contained a code execution vulnerability (CVE-2026-12957, CVSS 8.5) that allowed attackers to run arbitrary code and steal AWS credentials through malicious MCP config files in cloned repositories. All four IDE plugins (VS Code, JetBrains, Eclipse, Visual Studio) were affected. Developers who opened untrusted repos and approved workspace trust were at risk.

HIGHAdvisoryJun 26, 2026

Action required

Patch Language Servers for AWS to version 1.69.0 or later immediately across all development environments. Review developer activity logs for suspicious MCP server launches or credential access in the past 30 days.

Affected products

AmazonAmazon Q DeveloperLanguage Servers for AWSWiz Research

CVE IDs

CVE-2026-12957

Linked articles

Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

Source links

https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html