Amazon Q Developer Flaw Could Let Malicious Repos Run Code via MCP Configs

Kurzinfo

Metadaten

Original (extern): Link oeffnen
Veroeffentlicht: 2026-06-26 13:53 UTC
Importiert: 2026-07-02 11:44 UTC
CVSS: 8.5
Quelle-ID: thn_global
uid_hash: 2c94a2f2862923661c6454ec317bff51b743dc75dbadac29d8b325093c5c3553

The Hacker News

Inhalt

A high-severity flaw in Amazon Q Developer let a malicious repository run commands and steal a developer's cloud credentials. The path was short: a developer opens the repo, trusts the workspace, and Amazon Q does the rest. Amazon has patched it.

Tracked as CVE-2026-12957 (CVSS 8.5), the bug sat in how Amazon's AI coding assistant handled Model Context Protocol (MCP) servers.

Wiz

Verknuepfte CVEs

CVE-ID	Severity (Quelle)	CVSS (Quelle)	Severity (CVE.org)	CVSS (CVE.org)	EPSS	EPSS-Pctl	Veroeffentlicht (CVE.org)
CVE-2026-12957	HIGH	8.5	HIGH	8.5			2026-06-23

Quellen-Details

Bezeichnung	Name	Kategorie	Tags	Zielgruppe	Sprache	Feed-URL
The Hacker News	thn_global	security_news		-	de	https://feeds.feedburner.com/TheHackersNews

Zurueck zur Eintrags-Liste