---
schema: 1
kind: research
title: "CVE-2026-12957 — Amazon Q Developer auto-loaded workspace MCP configs, enabling repo-planted code execution and AWS credential theft (Wiz)"
headline: "CVE-2026-12957 — Amazon Q Developer auto-loaded workspace MCP configs, enabling repo-planted code execution and AWS credential theft (Wiz)"
summary: "Wiz Research disclosed (2026-06-26) that the Amazon Q Developer VS Code extension automatically loaded and executed Model Context Protocol (MCP) server configurations from a workspace's .amazonq/mcp.json with no user consent, workspace-trust check, or warning (Wiz Research, 2026-06-26)."
discovered_at: "2026-06-27T05:17:45Z"
event_date: 2026-06-26
run_id: 2026-06-27-40e791d4
priority: notable
immediate_action: null
tags:
  - vulnerabilities
  - supply-chain
  - ai-abuse
  - cloud
regions:
  - global
sectors:
  - technology
entities: []
cves:
  - id: CVE-2026-12957
    cvss: "8.5"
    epss: null
    type: null
    vector: user-interaction
    auth: default-config
    status:
      - poc-public
      - patch-available
sources:
  - url: "https://www.wiz.io/blog/amazon-q-vulnerability"
    publisher: Wiz Research
    role: primary
  - url: "https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds/5263202"
    publisher: The Register
    role: corroborating
closed_sources: []
evidence: []
verification: multi-source
sourcing_note: null
confidence: high
update_of: null
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
watchlist_hit: false
actions: []
migrated_from: briefs/2026-06-27.md
---

Wiz Research disclosed (2026-06-26) that the Amazon Q Developer VS Code extension automatically loaded and executed Model Context Protocol (MCP) server configurations from a workspace's `.amazonq/mcp.json` with **no user consent, workspace-trust check, or warning** ([Wiz Research, 2026-06-26](https://www.wiz.io/blog/amazon-q-vulnerability)). Spawned MCP processes inherited the developer's full environment — AWS session tokens, IAM credentials, SSH agent sockets — so cloning a malicious repository and opening it with Amazon Q active silently executed an attacker command; a minimal PoC ran `aws sts get-caller-identity` and POSTed the result to an external host with zero clicks ([The Register, 2026-06-26](https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds/5263202)). Wiz places it in a documented class of at least six MCP-auto-execution flaws across AI coding assistants (Cursor, Windsurf, Claude Code) — a workspace-trust-enforcement failure pattern, not a one-off. Affected: Language Server for AWS < 1.65.0; fixed in 1.65.0 (discovered 2026-04-17, patched 2026-05-12, public 2026-06-26).
**Why it matters to us:** Any CH/EU developer team using Amazon Q with AWS should confirm the language server is ≥ 1.65.0, audit repositories for `.amazonq/mcp.json`, and enforce VS Code workspace-trust policies so AI assistants do not auto-load configs from untrusted clones.