Amazon Q Developer Flaw Lets Malicious Repos Run Code via MCP Configs

A high-severity flaw in Amazon Q Developer, tracked as CVE-2026-12957, allowed malicious repositories to run commands and steal cloud credentials simply by being opened in an IDE. This vulnerability put developers at risk of having their sensitive AWS keys, cloud CLI tokens, and API secrets compromised.

https://osintsights.com/amazon-q-developer-flaw-lets-malicious-repos-run-code-via-mcp-configs?utm_source=mastodon&utm_medium=social

#AmazonQDeveloper #Cve202612957 #CloudCredentials #CodeExecution #McpConfigs