CVE-2026-18655 Broker Credential and OAuth Token Disclosure in AWS Labs Amazon MQ MCP Server via Prompt Injection
Prompt injection in AWS MQ MCP Server allows attackers to steal broker credentials and OAuth tokens by redirecting connections to malicious endpoints.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-18655?
CVE-2026-18655 is a high-severity vulnerability in AWS amazon-mq-mcp-server, published on 3 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context.
To remediate this issue, users should upgrade to version 2.0.24.
Weakness: CWE-923
Which versions are affected by CVE-2026-18655?
How do I fix CVE-2026-18655?
No fix has been published for CVE-2026-18655 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-18655 being exploited?
There is no known exploitation of CVE-2026-18655 in the wild and no public exploit code.