Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
Summary: A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, let a malicious repository run commands and steal a developer's cloud credentials by having the assistant read an MCP configuration file, .amazonq/mcp.json, from the open workspace and launch the servers it defined. Wiz Research, which reported the bug on April 20 and saw a fix on May 12, showed in its proof of concept that the spawned processes inherited the developer's full environment and could run aws sts get-caller-identity and ship the output to an attacker server; the flaw is fixed in Language Servers for AWS 1.65.0, though AWS's bulletin directs customers to 1.69.0, which also closes CVE-2026-12958.
Bottom line: The spawned MCP processes inherited the developer's live AWS keys, cloud CLI tokens, API secrets, and SSH agent sockets, so a single file in a cloned repo reached an active cloud session with no password and no second sign-in. Claude Code, Cursor, and Windsurf have all had project-level MCP config lead to command execution, which means the trust check around turning repo-carried configuration into a running process is the control that keeps failing.