CVE-2026-12958 - Vulnerability Details

Related Threat Clusters

• Amazon Q Developer Vulnerability Enables Cloud Credential Theft

  A high-severity vulnerability (CVE-2026-12957) in Amazon Q Developer for Visual Studio Code allowed attackers to execute arbitrary code and steal AWS credentials by automatically loading malicious MCP server…

  11 articles · Updated June 26, 2026
• GhostApproval Vulnerability Exposes AI Coding Assistants to Remote Code Execution

  A vulnerability named GhostApproval has been discovered in six major AI coding assistants, including Amazon Q Developer, Anthropic Claude Code, Augment, Cursor, Google Antigravity, and Windsurf. This flaw allows…

  17 articles · Updated July 8, 2026

Recent Intelligence Reports

• GhostApproval — www.wiz.io · July 10, 2026
• 2026 047 Aws — aws.amazon.com · July 9, 2026
• Bug in top AI coding agents shows that Unix — Theregister · July 9, 2026
• Amazon Q Developer Vulnerability Allows Code Execution via Malicious Repositories — Gbhackers · June 27, 2026
• Amazon Q Developer flaw allows cloud credential theft via malicious repositories — Cryptobriefing · June 27, 2026
• Amazon Q Developer Vulnerability Allows Cloud Credential Theft via Malicious Repositories — Kucoin · June 27, 2026
• Amazon Q Developer flaw let malicious repos steal AWS credentials via rogue MCP servers — Thenextweb · June 26, 2026
• Amazon Q Vulnerability Let Attackers Execute Code and Access Sensitive Cloud Environments — Cybersecuritynews · June 26, 2026

Related Entities