Amazon Patches CVE-2026-12957 in Q Developer: Malicious Repo Could Drain AWS Credentials via MCP
A workspace-trust prompt was all that stood between a developer and credential theft. Amazon has shipped a fix for the high-severity flaw in its AI coding assistant.
Amazon has patched a high-severity vulnerability in Q Developer that allowed a hostile repository to execute commands and exfiltrate a developer's cloud credentials. The fix is out. The disclosure window is closed.
The issue is tracked as CVE-2026-12957, carrying a CVSS base score of 8.5. It sat in how the assistant processed Model Context Protocol (MCP) server configurations bundled inside a repository.
The attack path is short, and that is what makes it notable. A developer clones or opens a repo. The IDE prompts to trust the workspace. The developer clicks yes, as developers routinely do. Amazon Q reads the MCP configuration shipped in that workspace and acts on it — including spawning a server process under the developer's identity.
From there, the malicious MCP server inherits the local environment. That environment, for most AWS developers, includes ambient credentials: profile tokens, SSO sessions, or instance role material reachable through the metadata service. Exfiltration is trivial once code execution lands.
The bug sits at the intersection of two design assumptions worth flagging. First, that workspace trust is a meaningful security boundary when AI agents auto-load configuration files. Second, that MCP server definitions in a repo are declarative data rather than executable intent. Neither assumption held here.
There is no formal regulator action attached to this disclosure. But it lands in the middle of an active policy conversation. The SEC's cyber disclosure rule under Item 1.05 of Form 8-K only reaches incidents deemed material to the registrant, and a patched developer-tool flaw with no confirmed exploitation will not, on its face, trigger reporting. CISA's CIRCIA reporting requirements remain in proposed-rule status, with the final rule not yet in effect, so covered-entity obligations for a supply-chain-style developer compromise are still a future problem rather than a present one.
For security teams, the practical guidance is narrow. Update Amazon Q Developer to the patched build. Audit any MCP server configurations carried into developer workstations from third-party repositories. Treat workspace-trust dialogs as a credential-exposure decision, not a UX nuisance.
The broader lesson is harder. AI coding assistants are now credential-adjacent processes running with the full ambient authority of the developer. Every new auto-loaded configuration format — MCP today, something else next quarter — expands the attack surface in a way traditional IDE threat models did not contemplate.
Expect more findings in this class. The MCP specification is young, adoption is racing ahead of hardening, and the trust model between agent, repo, and host is still being written in production.
