CVE-2026-12957 Amazon Q MCP AWS Credential Theft via aws sts get-caller-identity

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•4

Detects execution of AWS STS commands to identify the caller's identity in conjunction with suspicious outbound POST requests. This pattern is commonly used by adversaries to verify compromised cloud credentials or enumerate permissions within an AWS environment.