{"data":{"id":"290fffb5-fe7b-4411-bf1c-fd2c4783e2d0","title":"CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection","summary":"CVE-2026-18655 is a vulnerability in AWS Amazon MQ MCP Server (a tool that lets AI assistants communicate with Amazon MQ message brokers) versions 2.0.23 and earlier. An attacker can use prompt injection (tricking the AI by hiding instructions in its input) to trick the server into sending broker credentials or OAuth tokens (keys that prove you have permission to access a service) to a fake endpoint they control.","solution":"Update AWS Amazon MQ MCP Server to version 2.0.24 or later.","labels":["security"],"sourceUrl":"https://aws.amazon.com/security/security-bulletins/rss/2026-070-aws/","publishedAt":"2026-08-03T19:09:43.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"critical","attackType":["prompt_injection"],"issueType":"vulnerability","affectedPackages":null,"affectedVendors":["Amazon"],"affectedVendorsRaw":["AWS","Amazon MQ","Amazon MQ MCP Server"],"classifierModel":"claude-haiku-4-5-20251001","classifierPromptVersion":"v3","cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"patchAvailable":null,"disclosureDate":"2026-08-03T19:09:43.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["confidentiality","integrity"],"aiComponentTargeted":"api","llmSpecific":true,"classifierConfidence":0.95,"researchCategory":null,"atlasIds":null}}