CVE-2026-12957

Amazon Q Developer's VS Code extension automatically executed MCP server configurations from workspace files without user consent, exposing AWS credentials. Wiz Research disclosed CVE-2026-12957 (CVSS…

A vulnerability in Amazon Q Developer, tracked as CVE-2026-12957 with a CVSS score of 8.5, allowed attackers to steal AWS credentials by tricking developers into opening a malicious repository. The fl…

A high-severity flaw in Amazon Q Developer allowed malicious code repositories to silently execute commands on developers' machines and steal AWS credentials. Wiz Research discovered the vulnerability…