Amazon MQ MCP Server EUVD-2026-52406

Exploitation requires three conditions to be simultaneously true: (1) the target organization must be running awslabs.amazon-mq-mcp-server at version 2.0.23 or earlier with its RabbitMQ broker connection tools active; (2) an AI agent or LLM client must be using this MCP server and must be exposed to untrusted external input - such as user-supplied documents, fetched web content, or third-party tool outputs - that the attacker can influence to inject a crafted broker hostname; (3) the agent must invoke the broker connection tool during a session where the malicious hostname is present in its context. The CVSS UI:P metric confirms passive user interaction is required: a human operator's normal use of the agent while the malicious context is active is sufficient. Exploitation is limited to deployments where agents are permitted to process untrusted content alongside Amazon MQ tool access; isolated deployments receiving only fully trusted input are not exploitable. Authentication level of the human operator is irrelevant - the attacker's leverage is through the LLM's context, not a direct protocol channel.

The CVSS 4.0 score of 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N) reflects a network-accessible, low-complexity attack requiring no privileges and only passive user interaction - meaning the MCP client must be running and process attacker-influenced context, but the user need not take an explicit action beyond normal operation. The confidentiality impact is high: full credentials or OAuth tokens are exfiltrated. No EPSS score is present in the provided data, and the vulnerability is not listed in CISA KEV, so widespread or confirmed active exploitation is unconfirmed. The real-world attack surface is constrained to organizations running AI agent workflows that (a) use this specific MCP server against Amazon MQ for RabbitMQ and (b) expose those agents to untrusted input channels (documents, web content, third-party tool outputs) capable of carrying prompt injection payloads. This is not a trivial precondition, but prompt injection against MCP tools is an increasingly studied and exploited attack class in 2025-2026. The missing EPSS data means exploitation probability cannot be quantified; defenders should weight the CISA KEV absence as a signal of no confirmed mass exploitation, not as confirmation of safety.

An attacker embeds a crafted RabbitMQ broker hostname into content that will be processed by an AI agent using the vulnerable Amazon MQ MCP Server - for example, via a malicious document ingested during a retrieval-augmented generation workflow or a web page fetched by the agent. When the agent invokes the RabbitMQ broker connection tool using the injected hostname, the MCP server establishes a network connection to the attacker's endpoint and transmits the victim's Amazon MQ broker credentials or OAuth access tokens as part of the authentication handshake. The attacker captures these credentials and uses them to authenticate directly against the victim's Amazon MQ for RabbitMQ brokers.