CVE-2026-12957: Amazon Q Developer MCP Vulnerability — Detection and Remediation Guide

---
title: Potential Exploitation of CVE-2026-12957 - Amazon Q Spawning Shell
id: 550d9a23-0f72-4e3a-a8c5-1d2f3b4c5d6e
status: experimental
description: Detects potential exploitation of CVE-2026-12957 where Amazon Q Developer executes code via malicious MCP configs by spawning cmd or powershell.
references:
  - https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.execution
  - attack.t1059
  - cve.2026.12957
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - 'amazon-q'
      - 'Amazon Q'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
  condition: selection
falsepositives:
  - Legitimate developer build tasks initiated by Q (rare but possible)
level: high
---
title: Amazon Q Developer Accessing Cloud Credentials
id: 7a3f1c82-9e4b-4d67-bc12-3e5a8f901234
status: experimental
description: Detects Amazon Q processes reading credential files, potentially indicating exfiltration via CVE-2026-12957.
references:
  - https://thehackernews.com/2026/06/amazon-q-developer-flaw-could-let.html
author: Security Arsenal
date: 2026/06/15
tags:
  - attack.credential_access
  - attack.t1552.001
  - cve.2026.12957
logsource:
  category: file_access
  product: windows
detection:
  selection:
    Image|contains:
      - 'amazon-q'
    TargetFilename|contains:
      - '\.aws\credentials'
      - '\.aws\config'
  condition: selection
falsepositives:
  - Developer configuring AWS profile manually via Q
level: medium

// Hunt for Amazon Q Developer spawning unauthorized shells
DeviceProcessEvents
| where InitiatingProcessFileName contains "amazon-q" or InitiatingProcessFolderPath contains "Amazon Q"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "bash.exe", "wsl.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, CommandLine
| order by Timestamp desc


// Hunt for Amazon Q establishing network connections to non-AWS endpoints
DeviceNetworkEvents
| where InitiatingProcessFileName contains "amazon-q"
| where RemoteUrl !contains ".amazonaws.com" 
   and RemoteUrl !contains ".amazon.com"
   and RemoteUrl !contains ".amazontrust.com"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemotePort, RemoteIP
| order by Timestamp desc

-- Hunt for Amazon Q developer processes spawning shells
SELECT Parent.Name as ParentName, Child.Name as ChildName, Child.CommandLine, Child.Pid
FROM process_chain(parent=pslist())
WHERE Parent.Name =~ "amazon-q"
  AND Child.Name IN ("cmd.exe", "powershell.exe", "pwsh.exe", "bash", "sh")

# Audit Script for CVE-2026-12957 Indicators
Write-Host "[*] Scanning for MCP configurations and Amazon Q instances..." -ForegroundColor Cyan

# 1. Scan for suspicious MCP config files in common dev directories
$devPaths = @("$env:USERPROFILE\source", "$env:USERPROFILE\code", "C:\dev")
$mcpIndicators = @()

foreach ($path in $devPaths) {
    if (Test-Path $path) {
        Write-Host "[*] Scanning path: $path" -ForegroundColor DarkGray
        try {
            $files = Get-ChildItem -Path $path -Recurse -Filter "*." -ErrorAction SilentlyContinue
            foreach ($file in $files) {
                $content = Get-Content $file.FullName -Raw -ErrorAction SilentlyContinue
                if ($content -match "mcpServers" -or $content -match "\"mcp\"") {
                    $mcpIndicators += $file.FullName
                }
            }
        } catch {
            # Ignore access errors
        }
    }
}

if ($mcpIndicators.Count -gt 0) {
    Write-Host "[!] WARNING: Found potential MCP configuration files:" -ForegroundColor Yellow
    $mcpIndicators | ForEach-Object { Write-Host "    - $_" }
    Write-Host "[!] Recommendation: Audit these repositories immediately. Ensure they are from trusted sources." -ForegroundColor Yellow
} else {
    Write-Host "[+] No obvious MCP config files found in standard paths." -ForegroundColor Green
}

# 2. Check for running Amazon Q processes
$qProcess = Get-Process | Where-Object { $_.ProcessName -like "*amazon*q*" -or $_.MainWindowTitle -like "*Amazon Q*" }
if ($qProcess) {
    Write-Host "[*] Amazon Q is currently running. Ensure the extension is updated to the latest version provided by Amazon." -ForegroundColor Cyan
} else {
    Write-Host "[*] Amazon Q process not actively detected." -ForegroundColor DarkGray
}

Write-Host "[*] Remediation: Update Amazon Q Extension via VS Code / JetBrains Marketplace immediately." -ForegroundColor Cyan