Threat reportVulnerabilityTL-2026-0950
Amazon Q Developer Extension Trust-Boundary & Symlink Flaws (CVE-2026-12957, CVE-2026-12958) Auto-Execute Malicious MCP Configs
Amazon Q Developer Extension Trust-Boundary & Symlink Flaws (TL-2026-0950), also tracked as AWS-2026-047, is a high-severity software vulnerability scored CVSS 8.5, first published 2026-06-26. It has no confirmed attribution, affects Amazon Web Services Language Servers for AWS, references 2 CVEs (CVE-2026-12957, CVE-2026-12958), maps to 21 MITRE ATT&CK techniques (T1005, T1041, T1059.004), and is covered by 9 detection rules and 18 indicators of compromise.
- CVSS
- 8.5/10High
- CVEs
- 2Referenced vulnerabilities
- Techniques
- 21MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 18Indicators of compromise
Key facts for TL-2026-0950
- Threat ID
- TL-2026-0950
- Also known as
- AWS-2026-047, Amazon Q MCP auto-execution flaw
- Severity
- HIGH
- CVSS
- 8.5
- Status
- PATCHED
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, software development, cloud services, open source
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 18
How Amazon Q Developer Extension Trust-Boundary & Symlink Flaws works
Two high-severity flaws in the Amazon Q Developer extension let a malicious workspace silently auto-load and execute Model Context Protocol (MCP) server configurations from .amazonq/mcp.json with no prompt, consent, or workspace-trust check (CVE-2026-12957), while a missing symlink validation allows path traversal and arbitrary file writes outside the workspace boundary (CVE-2026-12958). Simply opening a booby-trapped Git repository with Amazon Q active yields arbitrary code execution and theft of the developer's AWS and cloud credentials.
Wiz Research disclosed two vulnerabilities in the Amazon Q Developer extension, which is powered across IDEs by the shared 'Language Servers for AWS' runtime. The core flaw, CVE-2026-12957 (improper trust boundary enforcement), arises because Amazon Q automatically read and acted on a Model Context Protocol (MCP) server configuration file, .amazonq/mcp.json, located in the root of the currently open workspace. MCP servers are local helper processes that an AI assistant spawns to reach databases, APIs, and build tools; Amazon Q launched the servers defined in that file with 'no prompt, no consent, no workspace trust check.' Because the spawned MCP server processes inherited the developer's full environment, an attacker who controlled the .amazonq/mcp.json file in a repository could execute arbitrary commands with the developer's complete credential context the moment the folder was opened with the extension active.
The security model assumed MCP servers would be explicitly configured by the user, but a workspace-supplied config violated that assumption. Spawned processes inherited AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), cloud CLI authentication tokens, API keys and secrets, and SSH agent sockets. Wiz demonstrated a working proof-of-concept: a single malicious .amazonq/mcp.json could run commands such as 'aws sts get-caller-identity' and exfiltrate active AWS session credentials to an attacker-controlled server with 'no clicks, no prompts, no warning.' Escalation paths included theft of cloud credentials (AWS, GCP, Azure), cloud persistence via backdoor IAM users / access keys / infrastructure, and access to internal services via inherited VPN/network context.
CVE-2026-12958 is a missing symlink validation flaw that allows path traversal outside workspace boundaries, enabling arbitrary file writes beyond the intended workspace trust boundary. An attacker could plant symlinks in a malicious repository so that file operations performed by the extension resolved to locations outside the workspace, corrupting or planting files (for example, in shell startup files or tool configuration directories) and reinforcing the code-execution and persistence outcomes of the primary flaw.
Realistic delivery vectors highlighted by the researchers include malicious pull requests to popular open-source repositories, typosquatted packages carrying hidden .amazonq configurations, and social-engineering lures such as 'fake job interview coding tests' that ask a victim to clone an attacker-controlled repository. Amazon assigned Security Bulletin AWS-2026-047. CVE-2026-12957 was fixed in Language Servers for AWS 1.65.0; AWS's bulletin directs customers to 1.69.0, which also closes CVE-2026-12958. The fix introduces a consent prompt before Amazon Q loads MCP servers from workspace configurations. No public in-the-wild exploitation has been reported; the issue is part of a broader 2025-2026 pattern of project-level / workspace-config trust failures in AI coding tools, alongside Claude Code (CVE-2025-59536) and Cursor (CVE-2025-54136).
MITRE ATT&CK techniques used in TL-2026-0950
Collection
Exfiltration
T1041 Exfiltration Over C2 Channel; T1567 Exfiltration Over Web Service
Execution
T1059.004 Unix Shell; T1204.002 Malicious File; T1559 Inter-Process Communication
Command and Control
Discovery
T1082 System Information Discovery; T1580 Cloud Infrastructure Discovery
Persistence
T1098.001 Additional Cloud Credentials; T1546 Event Triggered Execution
Initial Access
T1195.002 Compromise Software Supply Chain; T1566.002 Spearphishing Link
Credential Access
T1528 Steal Application Access Token; T1552.001 Credentials In Files; T1552.005 Cloud Instance Metadata API
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
privilege-escalation
T1548.002 Bypass User Account Control
Defense Evasion
Resource Development
Affected products and versions in Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
- Amazon Web Services — Language Servers for AWS
Vulnerable versions: < 1.69.0
Fixed in: 1.65.0 (CVE-2026-12957); 1.69.0 (both CVEs) - Amazon Web Services — Amazon Q Developer for VS Code
Vulnerable versions: < 2.20
Fixed in: 2.20 - Amazon Web Services — Amazon Q Developer for JetBrains
Vulnerable versions: < 4.3
Fixed in: 4.3 - Amazon Web Services — Amazon Q Developer for Eclipse
Vulnerable versions: < 2.7.4
Fixed in: 2.7.4 - Amazon Web Services — AWS Toolkit with Amazon Q for Visual Studio
Vulnerable versions: < 1.94.0.0
Fixed in: 1.94.0.0
Remediation for Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
Patches
- Language Servers for AWS 1.65.0 (CVE-2026-12957) and 1.69.0 (both CVEs) per AWS Security Bulletin AWS-2026-047
Immediate actions
- Upgrade Language Servers for AWS to 1.69.0 or later (closes both CVE-2026-12957 and CVE-2026-12958)
- Upgrade Amazon Q for VS Code to >= 2.20, JetBrains >= 4.3, Eclipse >= 2.7.4, AWS Toolkit with Amazon Q for Visual Studio >= 1.94.0.0
- Verify the extension's automatic-update feature is enabled and not blocked by network policy
- Audit and rotate any AWS access keys / session tokens that may have been exposed while working in untrusted repositories
Workarounds
- Before opening unfamiliar repositories, inspect for an unexpected .amazonq/ directory and review .amazonq/mcp.json contents
- Disable or do not activate Amazon Q when reviewing untrusted code until patched
- Open untrusted repositories in a disposable / sandboxed environment with no real cloud credentials present
Longer-term hardening
- Treat workspace-level AI/agent config files (.amazonq/mcp.json and equivalents) as untrusted external content subject to code review
- Run IDE AI assistants and MCP servers with least-privilege, scoped credentials rather than long-lived admin keys in the developer environment
- Use short-lived credentials (AWS STS / SSO) and avoid persisting AWS_SECRET_ACCESS_KEY in the shell environment
- Enforce explicit, per-workspace consent before any agent spawns local processes from repository-supplied configuration
CVEs associated with Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
Weaknesses (CWE) in Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
Timeline of Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
- Maor Dokhanian of Wiz Research discovers the Amazon Q MCP auto-execution trust-boundary flaw.
- Vulnerability responsibly disclosed to Amazon / AWS Security; report acknowledged.
- Amazon deploys the initial fix via a Language Servers for AWS update (1.65.0 for CVE-2026-12957), adding a consent prompt before loading workspace MCP servers.
- CVE-2026-12958 (missing symlink validation / path traversal outside workspace boundary) assigned.
- CVE-2026-12957 assigned.
- Language Servers for AWS 1.69.0 released, closing CVE-2026-12958 in addition to CVE-2026-12957 and adding the explicit consent prompt before any workspace-supplied MCP server is loaded.
- Disclosure framed within a broader 2025-2026 pattern of workspace/project-config trust failures in AI coding tools, alongside Claude Code (CVE-2025-59536) and Cursor (CVE-2025-54136).
- No in-the-wild exploitation reported; working Wiz PoC demonstrated. CISA Authorized Defense Program / KEV status listed as 'none'.
- Public disclosure of CVE-2026-12957 and CVE-2026-12958 under AWS Security Bulletin AWS-2026-047; Wiz publishes technical blog. Customers directed to Language Servers for AWS 1.69.0 (closes both CVEs).
Sources cited for Amazon Q Developer Extension Trust-Boundary & Symlink Flaws
- Amazon Q Vulnerability: Compromise via MCP Auto-Execution (Wiz Blog)
- Amazon Q Developer Extension Vulnerability Let Attackers Auto-Execute Malicious MCP Configs
- Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs
- Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds
- NVD - CVE-2026-12957
- NVD - CVE-2026-12958
Detection coverage for TL-2026-0950
As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0950 across Splunk SPL, Microsoft KQL and Sigma, covering 18 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.