AWS has patched a high-severity bug in the Amazon Q Developer extension that could let attackers steal cloud credentials just by getting a developer to open a malicious repository. Tracked as CVE-2026-12957 and discovered by Wiz Research, the flaw allowed Amazon Q to automatically load and execute MCP server configurations without user approval — silently, before any code review happened.
Because spawned processes inherited the developer's full environment, attackers could grab AWS credentials, API keys, SSH secrets and other sensitive environment variables. Wiz built a working proof of concept; no widespread attacks have been reported.
The fix landed in AWS Language Server version 1.65.0, which covers Amazon Q in VS Code and the other IDEs it supports. Update, then check your existing MCP configurations — patching stops new configs from auto-executing, but won't remove one a poisoned repo already dropped. Similar MCP-related vulnerabilities have also been found in Claude Code, Cursor and Windsurf.
Source: Dark Reading