tech
Amazon Q Developer flaw let malicious repos steal AWS credentials via rogue MCP servers
A flaw in Amazon Q Developer auto-loaded rogue MCP servers from cloned repos, letting attackers steal AWS credentials silently.
TL;DR
- A vulnerability (CVE-2026-12957) in Amazon Q Developer enabled the silent theft of AWS credentials.
- Attackers could exploit the flaw by including a malicious configuration file in a repository that automatically registered and started an attacker-controlled MCP server upon cloning.
- This rogue server inherited the developer's AWS credentials and environment variables, allowing access to cloud resources.
- A second flaw (CVE-2026-12958) allowed arbitrary file writing due to a lack of symbolic link checking.
- Amazon patched both vulnerabilities by implementing explicit user approval for MCP servers and restricting environment variable access.
- Developers are urged to update their IDE plugins and audit recently cloned repositories.