CVE-2026-12957 - Vulnerability Details

Related Threat Clusters

• Amazon Q Developer Vulnerability Enables Cloud Credential Theft

  A high-severity vulnerability (CVE-2026-12957) in Amazon Q Developer for Visual Studio Code allowed attackers to execute arbitrary code and steal AWS credentials by automatically loading malicious MCP server…

  11 articles · Updated June 26, 2026
• GhostApproval Vulnerability Exposes AI Coding Assistants to Remote Code Execution

  A vulnerability named GhostApproval has been discovered in six major AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw allows…

  17 articles · Updated July 8, 2026

Recent Intelligence Reports

• 2026 047 Aws — aws.amazon.com · July 9, 2026
• Amazon Q Vulnerability — www.wiz.io · June 29, 2026
• Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories — Gbhackers · June 27, 2026
• Amazon Q Developer flaw allows cloud credential theft via malicious repositories — Cryptobriefing · June 27, 2026
• Amazon Q Developer Vulnerability Allows Cloud Credential Theft via Malicious Repositories — Kucoin · June 27, 2026
• Amazon Q Developer extension vulnerability could have exposed cloud credentials — Feeds.Feedburner · June 26, 2026
• Amazon Q vulnerability allowed malicious Git repositories to steal cloud credentials — Feeds.4Sysops · June 26, 2026
• Amazon Q Developer flaw let malicious repos steal AWS credentials via rogue MCP servers — Thenextweb · June 26, 2026

Related Entities