Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments

Cybersecuritynews •Guru Baran • June 26, 2026

A high-severity vulnerability in the Amazon Q Developer Extension for Visual Studio Code (VS Code), Amazon’s AI-powered coding assistant. Tracked as CVE-2026-12957 and CVE-2026-12958 and disclosed by Wiz Research, the flaws allowed attackers to achieve arbitrary code execution and cloud credential theft simply by having a developer open a malicious repository. The root cause was […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Amazon Q Developer Vulnerability Enables Cloud Credential Theft A high-severity vulnerability (CVE-2026-12957) in Amazon Q Developer for Visual Studio Code allowed attackers to execute arbitrary code and steal AWS credentials by automatically loading malicious MCP server configurations from cloned repositories. Discovered by Wiz Research, the flaw permits silent execution of commands without user consent, inheriting the developer's environment variables. Amazon patched the issue on May 12, 2026, but the public disclosure occurred on June 26, 2026. The vulnerability affects multiple IDEs, including Visual Studio Code, JetBrains, and Eclipse. Similar vulnerabilities have been reported in other AI coding tools, indicating a systemic risk in the development ecosystem. Users are advised to update to version 1.69.0 for comprehensive protection. 11 sources 74

Extracted Entities

Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments

The full story

Extracted Entities

Attack Types (1)

CVEs (2)

CWE Weaknesses (2)

MITRE ATT&CK (1)

Platforms (1)