# Amazon Q Developer Extension Trust-Boundary & Symlink Flaws (CVE-2026-12957, CVE-2026-12958) Auto-Execute Malicious MCP Configs

> Two high-severity flaws in the Amazon Q Developer extension let a malicious workspace silently auto-load and execute Model Context Protocol (MCP) server configurations from .amazonq/mcp.json with no prompt, consent, or workspace-trust check (CVE-2026-12957), while a missing symlink validation allows path traversal and arbitrary file writes outside the workspace boundary (CVE-2026-12958). Simply opening a booby-trapped Git repository with Amazon Q active yields arbitrary code execution and theft of the developer's AWS and cloud credentials.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0950
- **ID:** TL-2026-0950
- **Severity:** HIGH (CVSS 8.5)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 18 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-12957, CVE-2026-12958

## Description

Wiz Research disclosed two vulnerabilities in the Amazon Q Developer extension, which is powered across IDEs by the shared 'Language Servers for AWS' runtime. The core flaw, CVE-2026-12957 (improper trust boundary enforcement), arises because Amazon Q automatically read and acted on a Model Context Protocol (MCP) server configuration file, .amazonq/mcp.json, located in the root of the currently open workspace. MCP servers are local helper processes that an AI assistant spawns to reach databases, APIs, and build tools; Amazon Q launched the servers defined in that file with 'no prompt, no consent, no workspace trust check.' Because the spawned MCP server processes inherited the developer's full environment, an attacker who controlled the .amazonq/mcp.json file in a repository could execute arbitrary commands with the developer's complete credential context the moment the folder was opened with the extension active.

The security model assumed MCP servers would be explicitly configured by the user, but a workspace-supplied config violated that assumption. Spawned processes inherited AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN), cloud CLI authentication tokens, API keys and secrets, and SSH agent sockets. Wiz demonstrated a working proof-of-concept: a single malicious .amazonq/mcp.json could run commands such as 'aws sts get-caller-identity' and exfiltrate active AWS session credentials to an attacker-controlled server with 'no clicks, no prompts, no warning.' Escalation paths included theft of cloud credentials (AWS, GCP, Azure), cloud persistence via backdoor IAM users / access keys / infrastructure, and access to internal services via inherited VPN/network context.

CVE-2026-12958 is a missing symlink validation flaw that allows path traversal outside workspace boundaries, enabling arbitrary file writes beyond the intended workspace trust boundary. An attacker could plant symlinks in a malicious repository so that file operations performed by the extension resolved to locations outside the workspace, corrupting or planting files (for example, in shell startup files or tool configuration directories) and reinforcing the code-execution and persistence outcomes of the primary flaw.

Realistic delivery vectors highlighted by the researchers include malicious pull requests to popular open-source repositories, typosquatted packages carrying hidden .amazonq configurations, and social-engineering lures such as 'fake job interview coding tests' that ask a victim to clone an attacker-controlled repository. Amazon assigned Security Bulletin AWS-2026-047. CVE-2026-12957 was fixed in Language Servers for AWS 1.65.0; AWS's bulletin directs customers to 1.69.0, which also closes CVE-2026-12958. The fix introduces a consent prompt before Amazon Q loads MCP servers from workspace configurations. No public in-the-wild exploitation has been reported; the issue is part of a broader 2025-2026 pattern of project-level / workspace-config trust failures in AI coding tools, alongside Claude Code (CVE-2025-59536) and Cursor (CVE-2025-54136).

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1586 Compromise Accounts
- T1195.002 Compromise Software Supply Chain
- T1566.002 Spearphishing Link
- T1059.004 Unix Shell
- T1204.002 Malicious File
- T1559 Inter-Process Communication
- T1546 Event Triggered Execution
- T1098.001 Additional Cloud Credentials
- T1548 Abuse Elevation Control Mechanism
- T1574 Hijack Execution Flow
- T1548.002 Bypass User Account Control
- T1552.001 Credentials In Files
- T1552.005 Cloud Instance Metadata API
- T1528 Steal Application Access Token
- T1580 Cloud Infrastructure Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service

## Sources

- [Amazon Q Vulnerability: Compromise via MCP Auto-Execution (Wiz Blog)](https://www.wiz.io/blog/amazon-q-vulnerability)
- [Amazon Q Developer Extension Vulnerability Let Attackers Auto-Execute Malicious MCP Configs](https://cybersecuritynews.com/amazon-q-vulnerability/)
- [Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs](https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html)
- [Amazon Q flaw let booby-trapped Git repos execute code, swipe cloud creds](https://www.theregister.com/cyber-crime/2026/06/26/amazon-q-flaw-let-booby-trapped-git-repos-execute-code-swipe-cloud-creds/5263202)
- [NVD - CVE-2026-12957](https://nvd.nist.gov/vuln/detail/CVE-2026-12957)
- [NVD - CVE-2026-12958](https://nvd.nist.gov/vuln/detail/CVE-2026-12958)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0950