How a .amazonq/mcp.json File in a Cloned Repo Silently Stole AWS Credentials Through Amazon Q Developer
- 1 hour ago
- 2 min read
On June 26, 2026, Wiz Research publicly disclosed CVE-2026-12957, a CVSS 8.5 vulnerability in the Amazon Q Developer extension for Visual Studio Code that turned the simple act of opening a cloned repository into arbitrary code execution and AWS credential theft. The Amazon Q Developer extension auto-loaded Model Context Protocol server configurations from a workspace-scoped file at .amazonq/mcp.json and spawned every server the file defined, without prompting the developer, without an allowlist, and without any sandbox between the workspace and the child process.
How the attack chain worked
Victim clones a repository that contains a crafted .amazonq/mcp.json file (any public repo, a compromised open-source project, or a shared internal repo).
Victim opens the folder in Visual Studio Code with Amazon Q Developer active.
The Amazon Q extension reads .amazonq/mcp.json and auto-launches every MCP server the file declares as a local subprocess.
Each MCP subprocess inherits the developer's full environment, which usually includes active AWS session credentials, cloud CLI tokens, additional API secrets, and the SSH agent socket.
A proof-of-concept from Wiz showed a single .amazonq/mcp.json file exfiltrating live AWS credentials to an attacker-controlled endpoint in under a second with no clicks and no warnings.
Versions, timeline, and the companion CVE
Affected versions are Language Servers for AWS below 1.65.0, and the issue is fixed in 1.65.0. A companion CVE, CVE-2026-12958, was filed in the same window and covers missing symbolic link validation that allowed path traversal outside the workspace boundary, with the same fixed version cutting off both attack paths.
April 17, 2026: Wiz Research discovered the vulnerability.
April 20, 2026: Wiz reported the issue to Amazon Security.
May 12, 2026: Amazon shipped a fix in Language Servers for AWS 1.65.0 that required user consent before any MCP server started from a workspace configuration.
June 23, 2026: MITRE assigned CVE-2026-12957 and CVE-2026-12958.
June 26, 2026: Wiz published the public write-up.
Why this is a pattern, not a one-off
OX Security disclosed CVE-2026-30615 in Windsurf on the same MCP auto-load design, and Check Point Research disclosed CVE-2025-59536 and CVE-2026-21852 in Claude Code on the same premise. The industry consensus that emerged over the week is that any coding assistant that materializes an MCP configuration from a repo it just opened must require explicit consent before spawning subprocesses, and any MCP host that inherits the developer's environment on launch has an implicit trust boundary that only stays intact as long as no repo the developer clones is malicious.
What builders should do
Require signed or user-approved MCP configurations on workspace open and never auto-launch MCP servers from repo-scoped configuration files.
Sandbox MCP subprocesses away from the developer environment by default, using tools like nsjail, Docker, or per-process credential scoping.
Treat every auto-load code path as an executable input that must clear the same authorization bar as a CI/CD pipeline step.
Audit .amazonq, .vscode, and similar workspace-scoped configuration folders when reviewing any pull request from an untrusted source.
Upgrade Amazon Q Developer to Language Servers for AWS 1.65.0 or later immediately, and rotate any AWS credentials that were live in a workspace opened before the fix.
