🟠 High | Source: AWS Security Bulletins
A vulnerability (CVE-2026-18655) in the AWS Labs Amazon MQ MCP Server allows an unauthenticated remote attacker to steal RabbitMQ broker credentials or OAuth access tokens by manipulating the broker hostname passed into the AI assistant’s context — a prompt injection attack. Versions 2.0.23 and earlier are affected. The flaw stems from insufficient validation of endpoint destinations in the RabbitMQ connection tooling, meaning credentials can be redirected to an attacker-controlled server.
Security Architect’s Take: Upgrade awslabs.amazon-mq-mcp-server to version 2.0.24 or later immediately, and audit any MCP client configurations to ensure broker hostnames cannot be injected via untrusted input sources such as AI-generated content or external message payloads. Consider applying network-level controls to restrict outbound connections from MCP servers to known, approved Amazon MQ endpoints only.
Original advisory: CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection