CVE-2026-12957 Amazon Q MCP Auto-Execution via .amazonq/mcp.json

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects the use of Amazon Q related configuration files (.amazonq, mcp.json) in conjunction with common command-line utilities such as bash, sh, npx, or node. This activity may indicate an attempt to interact with or exploit developer tools and environment configurations to perform unauthorized reconnaissance or execution.