Improper trust boundary enforcement in Language Servers for AWS before version 1

Amazon Q's Language Server auto-loaded Model Context Protocol configuration from a workspace file (.amazonq/mcp.json) the instant a developer opened the folder in VS Code, JetBrains, Eclipse, or Visual Studio. No consent prompt, no workspace-trust check, no signature verification. The MCP processes that got spawned inherited the developer's full process environment — AWS access keys, STS tokens, GitHub PATs, SSH agent sockets, kubeconfig — and could exfiltrate them or pivot directly into the cloud account. Affected: Language Servers for AWS < 1.65.0 across all platforms; Amazon's own bulletin pushes customers to 1.69.0.

Vendor scored this HIGH (7.8) with AV:L/UI:R. That's defensible but slightly understates reality: 'user interaction' here is *opening a repo*, which is the literal job description of a developer using an AI coding assistant. The CVSS vector treats it like a local exploit, but the attack vector is effectively any public Git repo, malicious npm dependency, or repo embedded in a tutorial. We agree with HIGH — not CRITICAL, because the chain still requires the dev to clone-and-open and the patch auto-deploys when the IDE restarts on a non-air-gapped network.

Why this verdict

• Role multiplier — developer endpoints are cloud-admin proxies: the chain ends in AWS credential theft, not a localhost compromise. In any org with >10 cloud devs, this is functionally a path to the cloud control plane → floor is HIGH.
• Friction — UI:R is real but cheap: the attacker still needs the victim to clone-and-open a repo. That's one social step, not zero, and that's the only thing keeping this off CRITICAL.
• Patch propagation is fast: Language Server auto-updates on IDE restart; most non-air-gapped fleets will be on ≥1.65.0 within a week of any restart, narrowing the exposure window organically.
• No KEV, low EPSS, no observed campaigns — we are not in active-exploitation territory; the upgrade pressure (KEV / mass scanning) is absent.
• Credential blast radius depends on IAM hygiene — orgs running short-lived SSO + MFA-enforced STS see the chain truncate at the IDE session; orgs with long-lived IAM user keys hit full account takeover.

Why not higher?

No active exploitation, no KEV listing, and the attack requires a target developer to actively clone and open a malicious repo in an Amazon Q-enabled IDE — that's a real, if low, friction point. CRITICAL is reserved for chains that fire without user choice or for components whose role guarantees fleet compromise on every install (hypervisors, DCs, kernel agents).

Why not lower?

Downgrading to MEDIUM would ignore the role multiplier: this lands on developer endpoints holding cloud admin credentials, with no env scrub and no sandbox on spawned MCP processes. A weaponized public PoC exists. Anything below HIGH undersells the credential-theft-to-cloud-pivot outcome.

1. Force Language Server upgrade to ≥ 1.65.0 (AWS recommends 1.69.0) fleet-wide — Push via MDM (Jamf, Intune, Workspace ONE) by restarting IDEs or pinning the extension version through VS Code enterprise policies. Deploy within 30 days per noisgate mitigation SLA for HIGH — but given a public PoC, treat as 7 days.
2. Block .amazonq/mcp.json at the source-control gateway — Add a GitHub/GitLab pre-receive hook or Semgrep rule that rejects commits containing .amazonq/mcp.json unless on an allowlisted repo. Stops accidental introduction via internal forks within 30 days.
3. Move all developers to short-lived SSO credentials via aws sso login / IAM Identity Center — Eliminates long-lived AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY material in dev env vars. STS session tokens with MFA and 1–4 hr TTL truncate the credential theft window. Rollout: 30 days.
4. GuardDuty + CloudTrail anomaly detection on dev IAM principals — Enable UnauthorizedAccess:IAMUser/AnomalousBehavior and source-IP/ASN anomaly rules with paging on dev admin roles. Catches use of stolen creds from attacker infra within minutes. Immediate.
5. Strip secrets from IDE child-process env via wrapper — On macOS/Linux, replace developer shell init so AWS/GitHub/NPM tokens load only into named subshells, not the IDE process tree. Defense in depth in case another extension repeats this mistake.

Run on each developer workstation (Windows shown; mirror on macOS/Linux). Requires user-context only — no admin. Invoke: powershell -ExecutionPolicy Bypass -File Check-AmazonQLS.ps1. Exits 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN/not installed.

# Check-AmazonQLS.ps1
# noisgate verifier for CVE-2026-12957 (Language Servers for AWS < 1.65.0)
# Exit codes: 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN

$ErrorActionPreference = 'SilentlyContinue'
$MinFixed = [version]'1.65.0'
$found = $false
$vulnerable = $false

# Candidate roots: VS Code, VS Code Insiders, Cursor, JetBrains, Visual Studio extension caches
$roots = @(
  "$env:USERPROFILE\.vscode\extensions",
  "$env:USERPROFILE\.vscode-insiders\extensions",
  "$env:USERPROFILE\.cursor\extensions",
  "$env:APPDATA\JetBrains",
  "$env:LOCALAPPDATA\aws\amazonq",
  "$env:USERPROFILE\.aws\amazonq"
)

foreach ($root in $roots) {
    if (-not (Test-Path $root)) { continue }
    # Amazon Q extension dirs look like 'amazonwebservices.amazon-q-vscode-<ver>'
    $exts = Get-ChildItem -Path $root -Recurse -Directory -Filter '*amazon-q*' -ErrorAction SilentlyContinue
    foreach ($ext in $exts) {
        $found = $true
        # Language server binaries ship under resources/language-servers or similar
        $manifests = Get-ChildItem -Path $ext.FullName -Recurse -Include 'package.json','language-server-version.json','manifest.json' -ErrorAction SilentlyContinue
        foreach ($m in $manifests) {
            try {
                $json = Get-Content $m.FullName -Raw | ConvertFrom-Json
                $verStr = $null
                if ($json.languageServerVersion) { $verStr = $json.languageServerVersion }
                elseif ($json.version -and $m.Name -eq 'language-server-version.json') { $verStr = $json.version }
                if ($verStr) {
                    $clean = ($verStr -replace '[^0-9\.]','')
                    try {
                        $v = [version]$clean
                        Write-Host "Found Language Server $v at $($m.FullName)"
                        if ($v -lt $MinFixed) { $vulnerable = $true }
                    } catch {}
                }
            } catch {}
        }
    }
}

if (-not $found) {
    Write-Host 'UNKNOWN - Amazon Q / Language Servers for AWS not detected'
    exit 2
}
if ($vulnerable) {
    Write-Host 'VULNERABLE - Language Server < 1.65.0 present. Upgrade to >=1.69.0 (CVE-2026-12957).'
    exit 1
}
Write-Host 'PATCHED - All detected Language Servers >= 1.65.0'
exit 0

Sources

1. Wiz Research — MCP Auto-Execution write-up
2. AWS Security Bulletin (Language Servers for AWS)
3. The Hacker News coverage
4. The Register coverage
5. SecurityWeek coverage
6. Cybersecurity News analysis
7. SC Media brief
8. Model Context Protocol spec