Amazon Q Developer flaw allows cloud credential theft via malicious repositories
The flaw highlights the critical need for enhanced security measures in AI coding tools to prevent unauthorized access and data breaches. The post Amazon Q Developer flaw allows cloud credential theft via malicious repositories appeared first on Crypto Briefing.
Amazon Q Developer flaw allows cloud credential theft via malicious repositories A single malicious config file could silently siphon AWS credentials from any developer who opened the wrong repo Share Add us on Google by Editorial Team Jun. 27, 2026 A vulnerability in Amazon’s AI-powered coding assistant, Amazon Q Developer, allowed attackers to steal cloud credentials simply by tricking a developer into opening a poisoned code repository. The flaw, tracked as CVE-2026-12957, carries a CVSS score of 8.
5 out of 10. Wiz Research, the security firm that discovered the bug, found that the Amazon Q Developer extension for IDEs like Visual Studio Code would automatically load and execute Model Context Protocol (MCP) server configurations without asking the developer’s permission first. Open a malicious repo, and hidden commands run silently in the background with full access to your environment variables, including your AWS credentials.
How the attack works The exploit is elegant in its simplicity. An attacker places a single .amazonq/mcp.
json file inside a code repository. When an unsuspecting developer clones and opens that repo in their IDE with the Amazon Q Developer extension installed, the MCP configuration file runs automatically. Advertisement Those commands don’t run in some sandboxed environment.
They inherit the developer’s complete set of environment variables. For anyone working with AWS, that typically includes access keys, session tokens, and region configurations. The result is silent data exfiltration with no pop-up warnings, no permission dialogs, and no indication that anything happened at all.
Timeline and patch details Wiz reported the vulnerability to Amazon on April 20, 2026. Amazon released an initial patch on May 12, 2026, in Language Servers for AWS version 1.65.
0. Public disclosure followed on June 26, 2026, giving organizations roughly six weeks to update before the details went public. Amazon has recommended that users upgrade to version 1.
69.0 for more comprehensive protection. That later version also addresses a related vulnerability, CVE-2026-12958, which involves symlink validation issues in MCP configurations.
No instances of public exploitation have been recorded so far. A pattern, not an isolated incident Similar flaws have been reported around the same time for other AI coding tools, including Claude Code, Cursor, and Windsurf. The common thread is MCP, the Model Context Protocol that AI coding assistants use to connect with external tools and data sources.
When an AI coding tool automatically loads configuration files from a repository, it implicitly trusts whatever the repository author put there. For developers and organizations using AWS, the immediate action is straightforward: update your Amazon Q Developer extension to at least version 1.65.
0, ideally version 1.69.0.
Organizations running cloud workloads should also audit whether any of their developers may have opened unfamiliar repositories while the vulnerable extension was active. Rotating AWS credentials as a precaution is advisable given that the exploit leaves no visible trace. The CVSS score of 8.
5 puts this squarely in the “high severity” category. For context, a score above 9.0 is considered critical, and anything above 7.
0 demands prompt attention. Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.
TECHNOLOGY Amazon Q Developer flaw allows cloud credential theft via malicious repositories A single malicious config file could silently siphon AWS credentials from any developer who opened the wrong repo by Editorial Team Jun. 27, 2026 Share Add us on Google A vulnerability in Amazon’s AI-powered coding assistant, Amazon Q Developer, allowed attackers to steal cloud credentials simply by tricking a developer into opening a poisoned code repository. The flaw, tracked as CVE-2026-12957, carries a CVSS score of 8.
5 out of 10. Wiz Research, the security firm that discovered the bug, found that the Amazon Q Developer extension for IDEs like Visual Studio Code would automatically load and execute Model Context Protocol (MCP) server configurations without asking the developer’s permission first. Open a malicious repo, and hidden commands run silently in the background with full access to your environment variables, including your AWS credentials.
How the attack works The exploit is elegant in its simplicity. An attacker places a single .amazonq/mcp.
json file inside a code repository. When an unsuspecting developer clones and opens that repo in their IDE with the Amazon Q Developer extension installed, the MCP configuration file runs automatically. Advertisement Those commands don’t run in some sandboxed environment.
They inherit the developer’s complete set of environment variables. For anyone working with AWS, that typically includes access keys, session tokens, and region configurations. The result is silent data exfiltration with
Đọc thêm từ Tiền số / Crypto
Belgium thrashes New Zealand 5-1 as crypto prediction markets and fan tokens ride the World Cup wave
The surge in crypto prediction markets and fan tokens during the World Cup highlights a growing intersection of sports and digital finance, influencing fan engagement and investment strategies. The post Belgium thrashes New Zealand 5-1 as crypto prediction markets and fan tokens
Elijah Just’s late World Cup goal against Belgium sends ripples through crypto prediction markets
Crypto prediction markets gain traction as sports betting emerges as a potential mainstream use case, despite regulatory challenges. The post Elijah Just’s late World Cup goal against Belgium sends ripples through crypto prediction markets appeared first on Crypto Briefing.
Polymarket Traders Wager on Strategy’s STRC Reclaiming Par as Critics Call It a ‘Junk Bond’
STRC’s collapse below par has sparked intense debate as Strategy’s variable-rate preferred stock struggles beneath the $75 mark. Yet Polymarket bettors still see a path back, wagering that the stock will eventually reclaim its intended price, though not anytime soon. Few Companie
Chainlink’s CRE selected by DTCC for collateral management and Pangea for FX settlement
Chainlink's partnerships with DTCC and Pangea could revolutionize financial infrastructure, enhancing efficiency and security in global markets. The post Chainlink’s CRE selected by DTCC for collateral management and Pangea for FX settlement appeared first on Crypto Briefing.