Skip to content
AgentProv

2026-06-26 · 2026-Q2

Amazon Q Developer Silent MCP Config Auto-Load (CVE-2026-12957, CVE-2026-12958)

Primary layerL5 ConfigSecondary:L1 Credential

Who wrote the file that runs on open?

The question layer 5 asks, and failed here.
Fixable
Vendor patch
Vendor response
Patched
In the wild
No
Actor
Attacker

Target

Language Servers for AWS before 1.69.0; Amazon Q Developer for VS Code before 2.20, JetBrains before 4.3, Eclipse before 2.7.4; AWS Toolkit with Amazon Q for Visual Studio before 1.94.0.0

Impact

Opening a malicious repository silently executes commands and steals credentials, including AWS access keys, session tokens, cloud CLI tokens, API secrets, and SSH agent sockets, because spawned processes inherit the full developer environment

Root cause

The extension auto-loaded MCP server configurations from `.amazonq/mcp.json` workspace files with no user consent or workspace-trust verification (CVE-2026-12957, improper trust boundary), plus missing symlink validation (CVE-2026-12958); found by Wiz Research (Maor Dokhanian) on April 20, 2026 and patched May 12, 2026

CVEs

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: Amazon Q Developer Silent MCP Config Auto-Load (CVE-2026-12957, CVE-2026-12958) (2026-06-26). https://agentprov.com/incidents/2026-06-26-amazon-q-developer-silent-mcp-config-auto-load-cve-2026-12957-cve-2026-12958

Related