AWS Issues Security Bulletins for Two Vulnerabilities in Amazon Q Developer Plugins

Amazon Web Services (AWS) has issued security bulletins addressing two vulnerabilities, identified as CVE-2025-12957 and CVE-2025-12958, within its software development tools. The issues affect the Language Servers for AWS and the Amazon Q Developer Plugins, which are integrated into popular integrated development environments (IDEs) to assist developers with code completion, debugging, and cloud resource management.

The security bulletins, published under the identifier 2026-047, confirm the existence of these flaws but do not provide extensive technical details regarding the nature of the exploits or their potential impact. AWS typically uses such bulletins to alert customers to security issues that require attention, often preceding or accompanying patch releases. The lack of immediate detail on severity or exploitability suggests that AWS is in the early stages of disclosure, possibly while finalizing remediation steps.

Context and Background

The vulnerabilities are contained within the Language Servers for AWS and the Amazon Q Developer Plugins. These components serve as the bridge between a developer's local coding environment and AWS cloud services. The Language Server Protocol (LSP) allows editors to provide features like auto-completion and go-to-definition, while Amazon Q is an AI-powered developer tool that helps generate code, debug issues, and optimize cloud infrastructure.

By integrating these tools, developers rely on them to interact securely with their AWS accounts. Any vulnerability in these plugins could potentially compromise the integrity of the development environment or expose sensitive credentials if the plugins are improperly configured or exploited. AWS has a history of regularly updating these tools to address security concerns, ensuring that the connection between local IDEs and the cloud remains secure.

Who is Affected

Developers who use AWS-supported IDE plugins are potentially affected by these vulnerabilities. This includes users of common development environments such as Visual Studio Code, JetBrains IDEs, and Eclipse, which support the AWS Toolkit and Amazon Q extensions. The impact is most relevant to organizations that enforce strict security policies regarding development tools and cloud access.

Teams relying on Amazon Q for AI-assisted coding or AWS Toolkit for cloud resource management should monitor the situation closely. While the specific user base is not quantified in the advisory, the widespread adoption of these tools among AWS customers means that a significant number of development environments could be exposed until patches are applied. Organizations with sensitive data or critical infrastructure should prioritize verifying the status of their plugin installations.

What should you do?

AWS has not yet confirmed if a patch or update is available for these specific CVEs. Customers should monitor the AWS Security Bulletins page and the official AWS blog for updates regarding remediation. In the interim, organizations should review their access policies for development tools and ensure that least-privilege principles are applied to any AWS credentials used within IDEs.

What to do and how to stay safe: AWS

• Monitor AWS Security Bulletins and vendor channels for confirmed patches or updates for CVE-2025-12957 and CVE-2025-12958
• Audit IAM policies and credentials associated with development environments to ensure least-privilege access is enforced
• Review the configuration of AWS and Amazon Q plugins to ensure they are not exposing sensitive data or credentials unnecessarily
• Consider isolating development environments from production resources to reduce the risk of lateral movement if a plugin is compromised

Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What are the CVE IDs for the new AWS vulnerabilities?

The vulnerabilities are identified as CVE-2025-12957 and CVE-2025-12958.

Which AWS products are affected by these issues?

The Language Servers for AWS and the Amazon Q Developer Plugins are affected.

Is a patch available for these vulnerabilities?

The source material does not confirm the availability of a patch or update at this time.