CVE-2026-18655 - Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection

Summary

CVE-2026-18655 is an improper restriction of intended endpoints in the RabbitMQ broker connection tools of the AWS Labs Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24, affecting versions <= 2.0.23. A remote unauthenticated actor may obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens by sending them to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.

Mitigation

Fixed in 2.0.24. Upgrade awslabs.amazon-mq-mcp-server to version 2.0.24 or later.

Topics

• Model Context Protocol
• Prompt injection and jailbreaks

Related items

• HighCVE-2026-115413 - AWS API MCP Server OAuth token audience validation bypassSame vendor · AWS Security Bulletins
• MediumCVE-2026-116635 - Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP ServerSame vendor · AWS Security Bulletins
• MediumCVE-2026-120497 - Stored cross-site scripting in the HTML report generator of aidlc-traceability in AWS AI-DLC WorkflowsSame vendor · AWS Security Bulletins
• HighCVE-2026-115415 - Secret masking bypass in the environment tool in Strands Agents ToolsSame vendor · AWS Security Bulletins
• HighGHSA-4v6f-7vjh-6x4m: Strands Agents SDK: Exposure of data element to wrong session in the A2A ServerSame vendor · GitHub Advisory Database