CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.
Summary
The Amazon MQ MCP Server (a tool for managing message brokers) has a vulnerability where attackers can use prompt injection (tricking an AI by hiding instructions in its input) to trick the system into sending RabbitMQ broker credentials or OAuth access tokens (digital keys that grant access to accounts) to a fake endpoint they control. This affects versions before 2.0.24 and requires a broker hostname to be set up in the client context.
Solution / Mitigation
Users should upgrade to version 2.0.24 to fix this vulnerability.
Vulnerability Details
6.5(medium)
EPSS: 0.0%
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
network
low
none
required
August 3, 2026
Classification
Affected Vendors
Related Issues
Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-18655
First tracked: August 4, 2026 at 02:08 AM
Classified by LLM (prompt v3) · confidence: 92%