Amazon Patches CVE-2026-12957 in Q Developer: Malicious Repo Could Drain AWS Credentials via MCP

Key points

• Amazon has patched CVE-2026-12957, a high-severity flaw in Q Developer carrying a CVSS score of 8.5.
• A developer who trusts a malicious workspace lets Amazon Q auto-load a rogue MCP server configuration, handing it code execution under the developer's identity.
• That process inherits ambient AWS credentials, making exfiltration straightforward once execution lands.
• No confirmed exploitation has been reported and no regulator reporting obligation is triggered by this disclosure.
• Security teams should update Q Developer immediately and audit any third-party MCP configurations pulled onto developer workstations.

What exactly is the vulnerability?

The bug sits in how Amazon Q Developer handled Model Context Protocol (MCP) server definitions bundled inside a repository. MCP is a configuration format that tells AI coding assistants which external tools and servers to connect to. CVE-2026-12957 let a hostile repo smuggle in a malicious server definition and have it executed automatically once a developer trusted the workspace.

The attack path is short, and that brevity is what makes it notable. A developer clones or opens a repo. The IDE prompts for workspace trust. The developer clicks yes. Amazon Q reads the MCP configuration shipped in that workspace and spawns a server process under the developer's own identity, no further confirmation required.

From there, the malicious server inherits the local environment, and for most AWS developers that environment carries live credentials: profile tokens or SSO sessions. Exfiltration is trivial once code execution lands.

Should you worry about supply-chain exposure?

This class of attack doesn't require a compromised package registry or a hijacked dependency. A public repository on any hosting platform is enough. That lowers the bar considerably for anyone targeting developers who work with cloud infrastructure.

We've tracked MCP security problems since our first coverage on 29 May 2026, and this disclosure fits a pattern we flagged when the Flowise MCP flaw scored 9.9 CVSS on 1 June: the trust model between an AI agent and a host system is being written in production, and vendors are discovering its edges through CVEs rather than design review. Our reporting on the MCP enterprise overhaul from 26 June noted the same gap: the specification repositions itself as enterprise-ready while quietly offloading the hard security work onto builders.

Two design assumptions failed here. First, that workspace trust is a meaningful security boundary when AI agents auto-load configuration files. Second, that MCP server definitions are declarative data rather than executable intent. Neither held.

What are the regulatory angles?

There's no formal regulator action attached to this disclosure. The SEC's cyber disclosure rule under Item 1.05 of Form 8-K reaches only incidents material to the registrant; a patched developer-tool flaw with no confirmed exploitation won't, on its face, trigger reporting. CISA's CIRCIA requirements remain in proposed-rule status, so covered-entity obligations for a supply-chain-style developer compromise are still a future problem.

That won't last. Once CIRCIA's final rule takes effect, a credential-exfiltration path through a widely used AI coding assistant sits squarely in the kind of supply-chain scenario the rule was designed to capture.

What should security teams do now?

Update Amazon Q Developer to the patched build. Audit any MCP server configurations that have arrived on developer workstations from third-party repositories. Treat workspace-trust dialogs as a credential-exposure decision rather than a UX nuisance, and apply the same scrutiny you'd give a dependency added to a build pipeline.

AI coding assistants are now credential-adjacent processes running with the full ambient authority of the developer who launched them. Every new auto-loaded configuration format expands that attack surface in ways traditional IDE threat models never anticipated. The MCP specification is young, adoption is moving faster than hardening, and the Amazon Q patch won't be the last finding in this class.