Executive brief
AWS language servers used in Amazon Q Developer IDE plugins contain two security issues that could expose sensitive information to unauthorized parties. Amazon Q is a generative AI assistant that helps developers write code more efficiently within their development environments. If exploited, these vulnerabilities could allow attackers to intercept or access confidential data processed through the affected plugins, potentially compromising source code, credentials, or other sensitive information developers work with daily.
Technical details
CVE-2026-12957 and CVE-2026-12958 are information disclosure vulnerabilities affecting the language server implementations bundled with AWS and Amazon Q Developer plugins. The vulnerabilities exist in the language server communication layer used by IDE extensions to provide code analysis and AWS integration features. Attack vectors and preconditions are not fully detailed in the available advisory content, but the issues likely involve improper handling of sensitive data within language server protocol (LSP) messages or local inter-process communication. An attacker with access to the affected development environment could potentially retrieve sensitive information such as credentials, API keys, or source code details. Patches or fixes should be obtained from the AWS security bulletin referenced in the advisory.
Affected products
- AWS Language Servers for Amazon Q Developer plugins
- AWS Amazon Q Developer IDE plugins
Timeline
- 2026-09-22: disclosed