CVE-2026-12957 Amazon Q MCP Auto-Execution via Malicious .amazonq/mcp.json

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•4

This rule detects potentially suspicious process executions originating from the Amazon Q language server or related processes. It monitors for commands involving MCP configuration files, AWS STS identity verification, and generic HTTP POST requests, which may indicate unauthorized activity or credential/configuration harvesting.