CVE-2026-18655: Amazon MQ MCP Server Disclosure Flaw

CVE-2026-18655 Overview

CVE-2026-18655 affects the Amazon MQ Model Context Protocol (MCP) Server package awslabs.amazon-mq-mcp-server prior to version 2.0.24. The vulnerability stems from improper restriction of intended endpoints [CWE-923] in the RabbitMQ broker connection tools. A remote unauthenticated actor can leverage prompt injection to introduce a crafted broker hostname into the MCP client context. When the MCP server connects, it transmits Amazon MQ for RabbitMQ broker credentials or OAuth access tokens to the attacker-controlled endpoint. AWS assigned this issue as AWS Security Bulletin 2026-070 and released a fix in version 2.0.24.

Critical Impact
Attackers can exfiltrate RabbitMQ broker credentials and OAuth access tokens by manipulating MCP client context through prompt injection, enabling unauthorized access to Amazon MQ message brokers.

Affected Products

awslabs.amazon-mq-mcp-server versions prior to 2.0.24
Amazon MQ MCP Server integrations connecting to RabbitMQ brokers
MCP client environments consuming untrusted context that reaches the Amazon MQ MCP Server

Discovery Timeline

2026-08-03 - CVE-2026-18655 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18655

Vulnerability Analysis

The Amazon MQ MCP Server exposes tools that allow an AI assistant or MCP client to connect to RabbitMQ brokers. The server accepts a broker hostname parameter derived from the MCP client context. Because the server does not restrict the destination endpoint to a trusted allowlist, an attacker can inject a malicious hostname through prompt injection payloads reaching the MCP client.

When the connection tool executes, the server forwards authentication material — including RabbitMQ broker credentials and OAuth access tokens — to the attacker-supplied host. The vulnerability is classified as CWE-923: Improper Restriction of Communication Channel to Intended Endpoints. The flaw requires user interaction because a human operator or agent must approve or trigger the tool call, but it does not require prior authentication to the vulnerable component.

Root Cause

The root cause is missing validation of the broker endpoint before credentials are transmitted. Version 2.0.24 remediates the issue by constraining the destinations to which the MCP server will send authentication material. See the GitHub Security Advisory GHSA-xwj6-8x5h-hjp6 for the maintainer's technical description.

Attack Vector

Exploitation follows a prompt injection chain. An attacker plants a malicious instruction in content that the MCP client ingests, such as documentation, tickets, email, or webpages the assistant reads. The instruction directs the assistant to invoke the Amazon MQ connection tool using an attacker-controlled hostname. The MCP server dispatches the connection attempt and delivers credentials or OAuth tokens to the crafted endpoint. Refer to the AWS Security Bulletin 2026-070 for vendor guidance.

Detection Methods for CVE-2026-18655

Indicators of Compromise

Outbound RabbitMQ connection attempts (AMQP ports 5671/5672, management port 15672) from MCP server hosts to unexpected external destinations.
OAuth token requests or bearer tokens transmitted to hostnames outside the organization's Amazon MQ broker inventory.
MCP audit logs showing broker connection tool invocations with hostnames not matching approved Amazon MQ endpoints.
Presence of awslabs.amazon-mq-mcp-server package versions below 2.0.24 in Python environments, verifiable via PyPI.

Detection Strategies

Inventory all MCP server deployments and enumerate the installed version of awslabs.amazon-mq-mcp-server across developer workstations and CI/CD systems.
Correlate MCP tool invocation logs with network egress telemetry to identify broker connections to hostnames outside the approved Amazon MQ resource list.
Alert on Amazon MQ credential material or OAuth tokens appearing in DNS queries, TLS SNI fields, or HTTP hosts pointed at non-AWS domains.

Monitoring Recommendations

Continuously log MCP client tool calls including all parameters passed to the Amazon MQ connection tools, and retain logs for retrospective analysis.
Baseline the set of RabbitMQ broker hostnames used by legitimate workloads and generate alerts on deviation.
Monitor Amazon MQ CloudTrail events and broker authentication logs for logins from unexpected source IPs following suspected prompt injection incidents.

How to Mitigate CVE-2026-18655

Immediate Actions Required

Upgrade awslabs.amazon-mq-mcp-server to version 2.0.24 or later on every system where it is installed.
Rotate all Amazon MQ for RabbitMQ broker credentials and OAuth client secrets that were reachable through vulnerable MCP server deployments.
Audit MCP server logs for tool invocations referencing unfamiliar broker hostnames since the package was first deployed.
Restrict MCP server egress to the specific Amazon MQ broker endpoints required for operation.

Patch Information

AWS released awslabs.amazon-mq-mcp-server version 2.0.24, which restricts the endpoints to which broker connection tools may transmit credentials. The fix is distributed through PyPI and is documented in the AWS Security Bulletin 2026-070 and GHSA-xwj6-8x5h-hjp6.

Workarounds

Disable the Amazon MQ MCP Server until version 2.0.24 can be installed if patching is not immediately possible.
Apply host-based or network-layer egress filtering that restricts outbound RabbitMQ and OAuth traffic to known Amazon MQ broker hostnames.
Configure the MCP client to require explicit human approval before invoking Amazon MQ connection tools, and reject calls containing unexpected hostnames.
Isolate MCP servers that process untrusted input from networks holding production broker credentials.

bash

# Upgrade the vulnerable package to the fixed version
pip install --upgrade 'awslabs.amazon-mq-mcp-server>=2.0.24'

# Verify the installed version
pip show awslabs.amazon-mq-mcp-server | grep -i version