Executive Summary
A patched Amazon Q Developer flaw (CVE-2026-12957, CVSS 8.5) let a malicious repository run commands and steal a developer's cloud credentials once the workspace was trusted, via MCP server handling.
What Happened
A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it. Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon's AI coding assistant handled Model Context Protocol (MCP) servers. Wiz
Affected Products
- Amazon Q Developer
Vulnerability / Attack Technique
Malicious repository MCP configuration
Technical Mechanism
As reported by Wiz, the assistant's handling of MCP configuration in a trusted workspace allowed command execution.
AI Security Category
LLM03:2025 Supply Chain
Part of the MCP Security topic.
Part of the AI Supply Chain and AI SBOM topic.
Relevant Frameworks
RealGround Analysis
Trusting a workspace trusts its MCP configuration. RealGround analysis: only trust repositories you control.
Recommended Controls
- Update Amazon Q Developer
- Do not trust workspaces from unknown repositories
- Use short-lived cloud credentials on developer machines
Related RealGround Service
Secure AI Agent Build · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.