CVE-2026-12957 Amazon Q MCP Auto-Execution via Malicious mcp.json

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•4

This rule monitors for suspicious child processes (such as bash, curl, or aws cli) spawned by the Amazon Q IDE language server. These patterns are indicative of potential abuse of IDE plugins or language servers to execute system commands, exfiltrate credentials, or interact with cloud APIs, potentially utilizing custom MCP (Model Context Protocol) configurations.