Which versions of Amazon MQ MCP Server are affected by CVE-2026-18655?

Amazon MQ MCP Server before version 2.0.24 is vulnerable to credential exfiltration attacks that could expose messaging infrastructure credentials and authentication tokens.. A patch is available.

How to fix or mitigate CVE-2026-18655?

Within 24 hours, identify all systems running awslabs.amazon-mq-mcp-server and document current versions in use. Within 7 days, upgrade all installations to version 2.0.24 or later across development, staging, and production environments, prioritizing production systems first. Within 30 days, audit CloudTrail and MQ broker connection logs for suspicious hostname patterns or unusual API calls that may indicate prior exploitation, and force rotation of all RabbitMQ broker credentials and OAuth tokens that may have been exposed in systems running pre-2.0.24 versions.

Amazon MQ MCP Server CVE-2026-18655

Q: What is the CVSS score of CVE-2026-18655?

CVE-2026-18655 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52406 HIGH

Improper Restriction of Communication Channel to Intended Endpoints (CWE-923)

2026-08-03 AMZN

AWS Code Injection Amazon Mq Mcp Server

7.1

CVSS 4.0 · Vendor: AMZN

Severity by source

Vendor (AMZN) PRIMARY

7.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Prompt injection requires passive user interaction (UI:R); no privileges needed; only credentials exfiltrated with no integrity or availability impact.

3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (AMZN).

CVSS VectorVendor: AMZN

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Scope

Lifecycle Timeline

Analysis Updated

Aug 03, 2026 - 20:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 03, 2026 - 20:22 vuln.today

cvss_changed

Severity Changed

Aug 03, 2026 - 20:22 NVD

MEDIUM HIGH

CVSS changed

Aug 03, 2026 - 20:22 NVD

6.5 (MEDIUM) 7.1 (HIGH)

Analysis Generated

Aug 03, 2026 - 20:08 vuln.today

DescriptionCVE.org

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.

To remediate this issue, users should upgrade to version 2.0.24.

AnalysisAI

Credential exfiltration in Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 allows a remote unauthenticated attacker - operating through prompt injection - to redirect RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint by supplying a crafted broker hostname in the MCP client context. The RabbitMQ broker connection tools fail to validate that hostnames resolved through the MCP client context correspond to legitimate Amazon MQ broker endpoints, enabling a server-side request forgery-like exfiltration primitive. No public exploit code has been identified at time of analysis, no CISA KEV listing exists, and the vendor (Amazon) has released a confirmed fix in version 2.0.24.

Technical ContextAI

The affected component (CPE: cpe:2.3:a:aws:amazon-mq-mcp-server:*:*:*:*:*:*:*:*) is an MCP (Model Context Protocol) server that enables AI agents and LLM-driven workflows to interact programmatically with Amazon MQ for RabbitMQ brokers. MCP servers expose tool functions to LLM clients, and those tools can be invoked with parameters derived from the LLM's context - including untrusted external content. The root cause is CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints): the RabbitMQ broker connection tools do not enforce that broker hostnames supplied via the MCP client context resolve to legitimate Amazon MQ endpoints. As a result, authentication material - including broker credentials and OAuth access tokens - is forwarded to whatever host is named in the context, functioning similarly to an SSRF attack path where the trust boundary violation is triggered through prompt injection rather than a direct HTTP parameter.

RemediationAI

Upgrade to awslabs.amazon-mq-mcp-server version 2.0.24, which is the vendor-confirmed fix available on PyPI at https://pypi.org/project/awslabs.amazon-mq-mcp-server/2.0.24/; this is corroborated by the AWS security bulletin at https://aws.amazon.com/security/security-bulletins/2026-070-aws/. Organizations unable to upgrade immediately should restrict MCP client contexts to fully trusted input sources and disable agent access to Amazon MQ connection tools when processing any externally sourced or untrusted content (documents, web pages, third-party tool outputs), as this eliminates the prompt injection pathway; the trade-off is loss of automated broker interaction in those workflows. As a precautionary measure, rotate all Amazon MQ for RabbitMQ broker credentials and OAuth tokens that were in scope for any agent using the affected MCP server versions, since exfiltration may have occurred prior to detection.