{"id":13916,"date":"2026-06-27T10:03:57","date_gmt":"2026-06-27T10:03:57","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/06\/27\/amazon-q-vulnerability-let-attackers-execute-code-and-access-sensitive-cloud-environments\/"},"modified":"2026-06-27T10:03:57","modified_gmt":"2026-06-27T10:03:57","slug":"amazon-q-vulnerability-let-attackers-execute-code-and-access-sensitive-cloud-environments","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/06\/27\/amazon-q-vulnerability-let-attackers-execute-code-and-access-sensitive-cloud-environments\/","title":{"rendered":"Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments"},"content":{"rendered":"<p>    Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n    <!-- no image --><br \/>\n \t<BR><br \/>\n<BR><\/BR><\/p>\n<div>\n<p class=\"wp-block-paragraph\">A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon\u2019s AI-powered coding assistant.<\/p>\n<p class=\"wp-block-paragraph\">Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository.<\/p>\n<p class=\"wp-block-paragraph\">The root cause was Amazon Q\u2019s automatic loading of <a href=\"https:\/\/cybersecuritynews.com\/mcp-server\/\" target=\"_blank\" rel=\"noreferrer noopener\">MCP (Model Context Protocol) server<\/a> configurations from <code>.amazonq\/mcp.json<\/code> workspace files without user consent or workspace trust verification. Combined with full environment inheritance by spawned processes, this created a dangerous attack chain.<\/p>\n<h2 id=\"h-amazon-q-vulnerability\" class=\"wp-block-heading\"><strong>Amazon Q Vulnerability<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">When a developer opened a compromised repository with Amazon Q active, the extension silently executed commands defined in the malicious config. Since spawned processes inherited the developer\u2019s full environment, attackers gained immediate access to:<\/p>\n<ul class=\"wp-block-list\">\n<li>AWS credentials (<code>AWS_ACCESS_KEY_ID<\/code>, <code>AWS_SECRET_ACCESS_KEY<\/code>, <code>AWS_SESSION_TOKEN<\/code>)<\/li>\n<li>Cloud CLI authentication tokens<\/li>\n<li>API keys and secrets<\/li>\n<li>SSH agent sockets<\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/www.wiz.io\/blog\/amazon-q-vulnerability\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">A minimal proof-of-concept showed<\/a> that a single malicious <code>.amazonq\/mcp.json<\/code> file could exfiltrate active AWS session credentials to an attacker-controlled server \u2014 no clicks, no prompts, no warning.<\/p>\n<p class=\"wp-block-paragraph\">Two CVEs were assigned as part of this disclosure:<\/p>\n<ul class=\"wp-block-list\">\n<li>CVE-2026-12957 \u2014 Improper trust boundary enforcement; MCP configs auto-executed without consent<\/li>\n<li>CVE-2026-12958 \u2014 Missing symlink validation allowing path traversal outside workspace boundaries<\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\">The following product versions are affected:<\/p>\n<figure class=\"wp-block-table\">\n<table class=\"has-fixed-layout\">\n<thead>\n<tr>\n<th>Product<\/th>\n<th>Affected Version<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>Language Servers for AWS<\/td>\n<td>&lt; 1.69.0<\/td>\n<\/tr>\n<tr>\n<td>Amazon Q Developer for VS Code<\/td>\n<td>&lt; 2.20<\/td>\n<\/tr>\n<tr>\n<td>Amazon Q Developer for JetBrains<\/td>\n<td>&lt; 4.3<\/td>\n<\/tr>\n<tr>\n<td>Amazon Q Developer for Eclipse<\/td>\n<td>&lt; 2.7.4<\/td>\n<\/tr>\n<tr>\n<td>AWS Toolkit with Amazon Q for Visual Studio<\/td>\n<td>&lt; 1.94.0.0<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n<h2 id=\"h-attack-scenarios\" class=\"wp-block-heading\"><strong>Attack Scenarios<\/strong><\/h2>\n<p class=\"wp-block-paragraph\">Beyond opportunistic exploitation, researchers highlighted several targeted attack vectors:<\/p>\n<ul class=\"wp-block-list\">\n<li>Malicious pull requests to popular open-source repositories<\/li>\n<li>Typosquatted packages embedding hidden <code>.amazonq\/<\/code> configurations<\/li>\n<li>Fake job interview coding tests \u2014 a known tactic used by DPRK-linked threat actors \u2014 where candidates are asked to clone and run attacker-controlled repositories<\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\">Amazon has patched both vulnerabilities in Language Servers for AWS version 1.69.0. The language server updates automatically for most users; reloading the IDE triggers the update. No action is required for users already on patched versions.<\/p>\n<p class=\"wp-block-paragraph\">Developers should take these precautions regardless:<\/p>\n<ul class=\"wp-block-list\">\n<li>Update all Amazon Q Developer plugins to their latest versions immediately<\/li>\n<li>Treat unfamiliar or unverified repositories as untrusted<\/li>\n<li>Inspect <code>.amazonq\/<\/code> directories in cloned repositories for unexpected MCP configurations<\/li>\n<li>Carefully review Amazon Q\u2019s new \u201cUntrusted MCP Server\u201d consent prompts before approving execution<\/li>\n<\/ul>\n<p class=\"wp-block-paragraph\">This vulnerability reflects a broader pattern across AI coding tools. Check Point Research independently identified CVE-2025-59536 and CVE-2026-21852 in Claude Code, and OX Security discovered CVE-2026-30615 in Windsurf \u2014 all rooted in the same auto-execution risk. MCP auto-execution without consent is now recognized as a systemic industry risk requiring coordinated attention.<\/p>\n<p class=\"wp-block-paragraph\">The vulnerability was discovered by Maor Dokhanian of Wiz Research and disclosed responsibly to Amazon on April 20, 2026. Amazon deployed the initial fix on May 12, 2026, with full public disclosure on June 26, 2026, under <a href=\"https:\/\/aws.amazon.com\/security\/security-bulletins\/2026-047-aws\/\" target=\"_blank\" rel=\"noreferrer noopener nofollow\">Security Bulletin 2026-047-AWS<\/a>.<\/p>\n<p class=\"has-text-align-center has-background wp-block-paragraph\" style=\"background:linear-gradient(180deg,rgb(238,238,238) 91%,rgb(169,184,195) 100%)\"><strong><strong><strong><strong>Upgrade your proactive defense against attacks. Access\u00a0<a href=\"https:\/\/any.run\/cybersecurity-blog\/threat-hunting-for-soc-and-mssp\/?utm_source=csn&amp;utm_medium=links&amp;utm_campaign=threat+hunter&amp;utm_content=blog&amp;utm_term=250626\" target=\"_blank\" rel=\"noreferrer noopener\">5 proven threat hunting tactics<\/a>\u00a0you can deploy in your SOC<\/strong><\/strong><\/strong>.<\/strong><\/p>\n<p>The post <a href=\"https:\/\/cybersecuritynews.com\/amazon-q-vulnerability\/\">Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments<\/a> appeared first on <a href=\"https:\/\/cybersecuritynews.com\/\">Cyber Security News<\/a>.<\/p>\n<\/div>\n<p> \t<BR><br \/>\n <BR><\/BR><br \/>\n    Guru Baran<br \/>\n \t<BR><br \/>\n<BR><\/BR><br \/>\n<a href=\"https:\/\/cybersecuritynews.com\/amazon-q-vulnerability\/\">Go to cyber-security-news<\/a><br \/>\n \t<BR><br \/>\n <BR><\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon\u2019s AI-powered coding assistant. Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,131,648],"tags":[130],"class_list":["post-13916","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-vulnerability","category-vulnerability-news","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13916"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=13916"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/13916\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=13916"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=13916"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=13916"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}