CVE-2026-18655: Amazon MQ MCP Server RabbitMQ broker tools leak credentials via crafted endpoint

Summary

CVE-2026-18655 is an improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24. A remote unauthenticated actor, via prompt injection, may obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context. The CNA, AMZN, rates it CVSS 4.0 7.1 HIGH, and NIST has not yet provided an assessment.

Mitigation

To remediate this issue, users should upgrade to version 2.0.24.

Topics

• Model Context Protocol

Related items

• InfoTop agent skill security resources — November 2026Similar attack · Adversa AI Blog
• InfoHow to Turn AI Red Team Findings Into Runtime ControlsSimilar attack · Straiker Blog
• MediumDocker Sandboxes vulnerability lets AI agents access sensitive files outside their sandbox (CVE-2026-103916) | Endor LabsSimilar attack · Endor Labs Blog
• MediumFree the Model, Sell the Gateway: Prompt Adware hidden in Jailbreak BundlesSimilar attack · Check Point Research
• InfoRight Tool, Wrong Parameters: Defending LLM Agents Against Parameter PoisoningSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)