Amazon Q VS Code Vulnerability Enabled Code Execution and Cloud Credential Theft

Summary

CVE-2026-12957 let malicious workspace MCP configurations execute commands through Amazon Q for VS Code, potentially exposing developer credentials. AWS fixed the issue in language server version 1.65.0.

Key points

Amazon Q automatically loaded workspace .amazonq/mcp.json MCP configurations without user consent or a workspace trust check.
When Amazon Q was activated, malicious configurations could execute arbitrary commands with the developer’s inherited environment.
The researchers demonstrated access to an active AWS session; exposed secrets could also include API keys and tokens.
Affected language server versions were earlier than 1.65.0; AWS says the issue is fixed in version 1.65.0.
The issue was disclosed as CVE-2026-12957. AWS language server updates automatically in most cases; reloading the IDE can trigger an update.
Developers are advised to treat unfamiliar repositories and workspace MCP configurations as untrusted, and review consent prompts before allowing servers.

Article Details

Vulnerability Types: Arbitrary code execution through automatic execution of workspace MCP server configurations without user consent
Exposure and potential theft of inherited cloud credentials and other environment secrets
Severity: High
Affected Versions: Language server versions earlier than 1.65.0
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: available
Workarounds: Use language server version 1.65.0 or later.
Treat unfamiliar repositories cautiously and check for unexpected .amazonq/ directories and MCP configurations.
Review MCP commands carefully before approving consent prompts.