Security researchers at Wiz have revealed a high-severity vulnerability in the Amazon Q Developer extension for Visual Studio Code that could have allowed attackers to steal cloud credentials simply by convincing a developer to open a malicious code repository.

The flaw stemmed from the extension’s handling of workspace configuration files. Instead of requesting user approval, the software would automatically process embedded settings and execute commands in the background. An attacker could therefore create a booby-trapped repository that silently launched malicious commands as soon as it was opened, gaining access to any active cloud credentials or API keys stored in the developer’s environment.

Figure 1. Cloud Credentials.

Wiz warned that realistic attack scenarios could include fake coding assignments, typosquatted open-source packages, or malicious pull requests submitted to popular projects. Developers who were already authenticated to Amazon Web Services or other cloud platforms would have faced the greatest risk, as active session credentials could potentially be captured and exfiltrated without any visible warning.

“The combination of auto-execution, shell spawning, and environment inheritance created a high-severity vulnerability in a widely-used developer tool. A single malicious repository could compromise not just the developer’s local machine, but their cloud infrastructure as well,” Wiz noted. Figure 1 shows Cloud Credentials.

AWS was informed of the issue on April 20, and the company released a patch on May 12. The vulnerability has been tracked as CVE-2026-12957, while a related symbolic-link handling issue has been assigned CVE-2026-12958. Fixes are available for Amazon Q Developer plugins used with VS Code, JetBrains IDEs, Eclipse, Visual Studio, and the underlying language server.

An AWS spokesperson said the company had remediated the issue in language server version 1.65.0 and noted that updates are installed automatically in most environments [1]. Existing users can typically receive the fix by reloading their IDE, while new installations will download the patched version by default.

Wiz also emphasized that the problem is not unique to Amazon Q Developer. Similar security concerns involving automatic execution and workspace trust have been identified in other AI-assisted coding tools, including Claude and Cursor, highlighting broader risks across the rapidly growing ecosystem of AI developer assistants.

Reference:

1. https://www.securityweek.com/amazon-q-flaw-enabled-cloud-credential-theft-via-malicious-repositories/

Cite this article:

Keerthana S (2026), Amazon Q Vulnerability Exposed Cloud Credentials, AnaTechMaz, pp.200.