Security · 2h ago
Amazon Q Developer Bug Let Malicious Repos Steal Cloud Credentials
A high-severity flaw in Amazon Q Developer allowed malicious repositories to execute commands and steal developers' cloud credentials via MCP configs. Tracked as CVE-2026-12957 with a CVSS score of 8.5, the bug was patched by Amazon. The attack required only that a developer open and trust the malicious workspace.
Meridian48 take
The flaw highlights the risks of AI coding assistants automatically trusting third-party configurations, a vector that could be exploited in supply-chain attacks.
Read the full reporting
Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs →
The Hacker News
amazon-q-developersupply-chain-security