Reviewing Amazon Q Developer — the MCP auto-execution CVE

Like most IDE-integrated coding agents, Q Developer reads workspace configuration automatically to know what tools and MCP servers are available in a given project — that's the feature that makes per-project MCP tooling convenient instead of something a developer has to re-declare by hand every session. Convenience and automatic trust are the same design decision wearing two names, and CVE-2026-12957 is what happens when that decision doesn't distinguish a project the developer set up from a project someone else authored.

The developer didn't run anything, approve anything, or even interact with Q Developer directly. Opening the folder was the entire attack surface. Wiz researcher Maor Dokhanian's proof of concept was a one-line .amazonq/mcp.json piping aws sts get-caller-identity to an attacker-controlled endpoint — full identity compromise from opening a booby-trapped repo in the IDE, no clicks beyond that.

Per AWS's own security bulletin, CVE-2026-12957 itself was fixed in Language Servers for AWS 1.65.0 — but AWS directs customers to update to 1.69.0, which also addresses a second, related issue.

CVE-2026-12958, disclosed in the same AWS bulletin, is a missing symlink-validation flaw that permits path traversal outside the intended workspace boundary. Fixes for both CVEs shipped across every Amazon Q Developer plugin surface — VS Code, JetBrains, Eclipse, and Visual Studio — plus the underlying language server itself, meaning a review needs to confirm the fixed version across each IDE integration in use, not just one.

The specific CVE is Q Developer's, but the pattern it exposes — workspace-level MCP or agent configuration files read and executed automatically on open, with no per-server trust decision — is common across IDE-integrated agents generally, not unique to this one product. A repository is, by definition, something that can come from someone else: a fork, a contributor's branch, a dependency pulled in as a submodule. Any agent that treats a workspace config file as trusted by default is exposed to some version of this same chain.

See the MCP server review checklist for the general version of the auto-execution question this CVE is a specific instance of.

For any team using Amazon Q Developer or another IDE-integrated coding agent with MCP support, a design-time review should be able to answer:

• Is Language Servers for AWS (and every IDE plugin — VS Code, JetBrains, Eclipse, Visual Studio) patched to version 1.69.0 or later, closing both CVE-2026-12957 and CVE-2026-12958?
• Does the IDE integration require explicit developer consent before starting an MCP server declared in a cloned repository, or does it auto-execute on open?
• Are AWS credentials available to a developer's local environment scoped to what that developer's actual work requires, limiting the blast radius if a credential is exfiltrated?
• Is there a policy for what happens when a repository from an external contributor or fork is opened — does it get the same automatic trust as an internally authored one?