CVE-2026-18655: Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs

What it is

CVE-2026-18655, published 2026-08-03 and still "Awaiting Analysis" in NVD, is an improper-endpoint-restriction flaw (CWE-923) in the RabbitMQ broker connection tools of awslabs.amazon-mq-mcp-server before 2.0.24. The existing summary has the mechanism and fix; what it omits is the full CVSS 4.0 vector, which qualifies the "remote unauthenticated" framing.

How it works / severity detail

The scored vector is CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N (base 7.1 HIGH). Two parts of that are worth surfacing to a triage decision:

• UI:P — passive user interaction is required. The prompt injection has to land in the MCP client context and be acted on; this is not a fully hands-off remote exploit despite PR:N (no privileges required).
• VC:H, VI:N, VA:N — impact is confidentiality-only. The named consequence is leakage of Amazon MQ for RabbitMQ broker credentials or OAuth access tokens to an attacker-controlled endpoint reached via a broker hostname injected into the client context. There is no integrity or availability impact in the scoring, and scope/subsequent-system metrics are all None.

For prioritization: the exposure is credential/token disclosure, not takeover or disruption, and it depends on the client processing injected content.

What to do

Upgrade to awslabs.amazon-mq-mcp-server 2.0.24, which the fix is published under on PyPI (https://pypi.org/project/awslabs.amazon-mq-mcp-server/2.0.24/). Corroborating references are the AWS security bulletin (2026-070-aws) and GitHub advisory GHSA-xwj6-8x5h-hjp6. The page states no workaround other than the upgrade.

Caveats

NVD status is "Awaiting Analysis," so the CWE, vector, and score reflect the initial (likely CNA-supplied) assessment and could be revised. Because leaked tokens land at an attacker endpoint, upgrading does not undo prior exposure — rotate any Amazon MQ for RabbitMQ credentials or OAuth tokens that could have transited an affected server, though the page itself does not state this.