Skip to content
Submit incident
AII-1000-26791
ConfirmedA court, a regulator or the organization itself has stated the core facts, or the record cites a court or regulator source.

Amazon Q automatic MCP configuration execution exposes AWS credentials

A vulnerability in Amazon Q Developer allowed attackers to steal AWS credentials and execute arbitrary code when developers opened malicious code repositories. The flaw automatically executed Model Context Protocol configurations without user consent, inheriting full access to environment variables including cloud credentials.

20 April 2026 Β· Amazon Β· Security and cyberattacks
20 April 2026

Drafted by Raidu Incident Detection, an automated system.

AII-1000-267913 sources ↓
Quick facts
Category
Security and cyberattacks
Country
United States
Source
Cyber Security News
Date
20 April 2026
Drafted by
Raidu Incident Detection

What happened

Amazon Q Developer automatically executed Model Context Protocol (MCP) server configurations from .amazonq/mcp.json files without user consent or workspace trust verification. When a developer opened a malicious repository containing a poisoned MCP configuration file, hidden commands ran silently in the background with full access to the developer's environment variables, including AWS credentials.

Reported impact

The vulnerability allowed attackers to steal AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), cloud CLI authentication tokens, API keys and secrets, and SSH agent sockets from developers who opened malicious repositories. No instances of public exploitation were recorded.

Index analysis

Two CVEs were assigned: CVE-2026-12957 for improper trust boundary enforcement and automatic execution of MCP configs without consent, and CVE-2026-12958 for missing symlink validation allowing path traversal. The vulnerability affected Language Servers for AWS versions below 1.69.0, Amazon Q Developer for VS Code below 2.20, Amazon Q Developer for JetBrains below 4.3, Amazon Q Developer for Eclipse below 2.7.4, and AWS Toolkit with Amazon Q for Visual Studio below 1.94.0.0.

Governance controls

Wiz Research reported the vulnerability to Amazon on April 20, 2026. Amazon released an initial patch on May 12, 2026, in Language Servers for AWS version 1.65.0, followed by a more comprehensive patch in version 1.69.0. Public disclosure occurred on June 26, 2026, approximately six weeks after the initial patch.

Classification

Category
Security and cyberattacks
Industry
Digital security
Country
United States
Harm status
Potential harm
Intent
Unintentional
Timing
Post-deployment
Harm types
Economic or property
Failure modes
Agent misaction, Data leak, Unsafe autonomous behaviour
AI systems
Amazon Q Developer

Sources and evidence

This record was researched and written by the Index, based on the following original reporting.

Cyber Security News
Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments
26 June 2026
TheRegister.com
Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds
26 June 2026
Crypto Briefing
Amazon Q Developer flaw allows cloud credential theft via malicious repositories
27 June 2026