CVE-2026-12957: Amazon Q Developer could run a repo's MCP server commands when you opened the project

Vulnerability · Amazon Q Developer · HIGH

Incident dateNot stated

DisclosedJun 23, 2026 (AWS bulletin 2026-047-AWS, GHSA-xhcr-j4j9-3gh7 and CVE-2026-12957). Wiz write-up Jun 26, 2026. Fixed in Language Servers for AWS 1.65.0.

Added hereOct 16, 9:32 AM ET

Last verifiedOct 16, 2026

Summary

AWS published CVE-2026-12957 on Jun 23, 2026 for Language Servers for AWS, the component behind Amazon Q Developer's AI coding features in VS Code, JetBrains, Eclipse and Visual Studio. Before version 1.65.0, commands in a workspace's project configuration files could run automatically after a user opened a malicious workspace. Wiz researcher Maor Dokhanian found it: Wiz says the Amazon Q VS Code extension loaded MCP server definitions from a repository's .amazonq/mcp.json and started them when Amazon Q was activated, with no consent prompt, and the processes inherited the developer's environment, including AWS credentials. AWS's advisory adds that the user had to trust the workspace when prompted. The CVE is rated CVSS 4.0 8.5 (High). AWS says the language server updates automatically, so most users were patched without doing anything. This is a backfill of an issue fixed in June. No exploitation has been reported.

Severity

HIGH High (CVSS 4.0 8.5, AWS as CNA; local attack vector, passive user interaction). The victim has to open an attacker-prepared repository with Amazon Q active; AWS says the workspace also had to be trusted. Fixed in Language Servers for AWS 1.65.0, which updates automatically. No exploitation reported.

Timeline

Jun 23, 2026
AWS publishes security bulletin 2026-047-AWS and GitHub advisory GHSA-xhcr-j4j9-3gh7 for CVE-2026-12957, fixed in Language Servers for AWS 1.65.0 (npm @aws/lsp-codewhisperer 0.0.113). The same bulletin covers CVE-2026-12958, a symlink issue fixed in 1.69.0. NVD publishes the CVE record the same day.
Jun 26, 2026
Wiz publishes its write-up with a proof of concept, and The Register reports on it.

How it happened

Amazon Q supports MCP, which lets the assistant start local helper processes defined in a JSON config. Wiz found the VS Code extension read .amazonq/mcp.json from the workspace root, a file anyone can commit to a repository, and launched the servers it listed once Amazon Q was activated, without asking. Those processes inherited the developer's full environment, so environment variables like AWS_ACCESS_KEY_ID and AWS_SESSION_TOKEN, CLI tokens and SSH agent sockets were within reach. Wiz's proof of concept was a repo whose mcp.json 'server' ran aws sts get-caller-identity and posted the output to an outside URL. AWS describes the flaw as improper trust boundary enforcement and says it required the user to trust the workspace when prompted. Wiz says the fixed version shows an 'Untrusted MCP Server' consent prompt before loading MCP servers from workspace configuration. Wiz lists similar workspace-config auto-execution bugs in Claude Code, Cursor and Windsurf.

How to check your app

Make sure Language Servers for AWS is 1.65.0 or later (1.69.0 or later also covers CVE-2026-12958). AWS says reloading the IDE triggers the update unless your network blocks it; if it does, update the Amazon Q Developer plugin for your IDE.
Look for a .amazonq folder in repositories you didn't write, and read .amazonq/mcp.json before opening the project with Amazon Q active.
When Amazon Q shows an 'Untrusted MCP Server' prompt, read the command before allowing it.
Avoid keeping long-lived AWS keys in your shell environment while working in unfamiliar repos; short-lived, scoped credentials limit what a malicious helper process can take.

Related on VibeIncidents

GhostApproval: symlink writes outside the project, including Amazon Q (CVE-2026-12958)

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.