Answers · MCP security
We use the AWS Labs Amazon MQ MCP server to let an assistant look at our RabbitMQ brokers. What is CVE-2026-18655, which version fixes it, and what should I change if I build a server whose tools log in to a host?
Last updated
TL;DR: CVE-2026-18655 (GHSA-xwj6-8x5h-hjp6, published August 3, 2026) affects awslabs.amazon-mq-mcp-server 2.0.23 and earlier. Its two RabbitMQ connection tools, rabbimq_broker_initialize_connection and rabbimq_broker_initialize_connection_with_oauth, were registered without any opt-in flag and took a broker_hostname argument straight from the model's tool call, then sent HTTPS requests to that host carrying the broker username and password (Basic authentication) or the OAuth access token. Text the agent reads can steer that argument, so prompt injection could point the login at a server someone else controls, and TLS doesn't help because that server can hold a valid certificate for its own name. Version 2.0.24 (on PyPI August 3, 2026) replaces broker_hostname with broker_id and region and looks the endpoint up through the Amazon MQ DescribeBroker API with your AWS credentials. Upgrade, rotate broker credentials as AWS recommends, and if you build servers, never let a tool argument choose where a secret is sent.
What should I check, step by step?
1. Check the installed version: awslabs.amazon-mq-mcp-server 2.0.23 and earlier are affected; 2.0.24 is the fixed release, and 2.1.1 was the newest on PyPI on November 14, 2026.
- If a client config uses @latest through uvx, restart it so it actually pulls a new build. A pinned or cached copy stays on the old version.
- Rotate the RabbitMQ broker passwords and any OAuth tokens the assistant was given while an affected version ran. AWS recommends rotating broker credentials after the upgrade.
- Until you upgrade, keep both connection tools off auto-approve and read the hostname in every call. AWS's suggested check: it should match <broker_id>.mq.<region>.on.aws.
- If you build an MCP server: don't accept a hostname or URL from the model for a request that carries a stored or user-supplied secret. Take an ID and resolve the endpoint yourself, as 2.0.24 does.
- Note that the fixed tools still take the broker password or OAuth token as tool arguments, so the secret sits in the model's context. Where your host allows it, keep those calls out of auto-approve and out of shared transcripts.
- Review logs for connection calls whose hostname didn't end in an Amazon MQ domain while an affected version was installed.
What does CVE-2026-18655 in the Amazon MQ MCP server let an attacker do?
AWS's advisory GHSA-xwj6-8x5h-hjp6 (CVE-2026-18655, CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, published August 3, 2026) says that before 2.0.24 the rabbimq_broker_initialize_connection and rabbimq_broker_initialize_connection_with_oauth tools put broker_hostname directly into HTTPS requests carrying the caller's broker credentials or OAuth access token, with no check that the destination was an Amazon MQ broker endpoint. The tool names keep their "rabbimq" spelling in the code.
- Because broker_hostname comes from a tool call the model writes, anyone who can influence the model's input, for example through text embedded in content the agent processes, can send those requests to an endpoint they control. The advisory notes TLS certificate checks don't stop this, since the attacker owns the destination name and can get a valid certificate for it.
- In the server's code the connection tools are registered on every start, together with the read-only RabbitMQ tools; the --allow-resource-creation flag only adds the tools that create or change resources, so the connection tools are present in every install.
How does Amazon MQ MCP server 2.0.24 fix CVE-2026-18655?
The fix commit in awslabs/mcp (947217066b, "replace broker_hostname with broker_id lookup via DescribeBroker API", August 3, 2026) removes the hostname argument. The tools now take broker_id and region, call DescribeBroker with the server's AWS client for that region, pick the amqps:// endpoint from the broker's endpoints and use its hostname. A broker ID that returns no instances or no AMQPS endpoint raises an error.
- PyPI lists 2.0.23 uploaded July 28, 2026 and 2.0.24 on August 3, 2026, the same day as the advisory. Later releases (2.0.25, 2.0.26, 2.1.0 and 2.1.1 by September 8) carry the fix.
- The username, password and oauth_token arguments are unchanged in the current code. The fix decides where they go, not how they reach the server, so the model still sees them in the call.
How should an MCP server choose where to send credentials so prompt injection can't redirect them?
Any tool that attaches a secret to an outbound request and lets the model choose the destination has the same shape, whether the secret is a stored API key, a database password or a token the user typed. Prompt injection only needs to change one string argument.
- The pattern in 2.0.24 is the general fix: accept an identifier the model can't turn into an arbitrary address, resolve it to an endpoint through an API or allowlist you trust, and send credentials only there. If a free-form host is unavoidable, check it against an allowlist of exact names or suffixes before any secret is attached, and refuse rather than warn.
- Approval prompts are the stopgap AWS names, and they work only if a person reads the argument. A host that auto-approves the tool turns them off.
How do I ask Rightshold about this (free, no key)?
Add the MCP server https://www.rightshold.com/mcp to Claude, Cursor, ChatGPT, Grok or VS Code, then ask: “Before my assistant connects to a RabbitMQ broker through the Amazon MQ MCP server, ask me to approve that exact connection, with the broker ID and region in the request, so a changed target can't slip through.”
{
"tool": "request_human_approval",
"arguments": {
"action": {
"tool": "rabbimq_broker_initialize_connection",
"mcp_server": "awslabs.amazon-mq-mcp-server",
"server_version": "2.1.1",
"broker_id": "<your broker ID>",
"region": "us-east-1"
},
"summary": "Connect the assistant to the production RabbitMQ broker on Amazon MQ",
"expires_in_minutes": 30
}
}- Needs a key for your account. It hashes the action details and returns an approval id and a one-time token for the owner. Only the account owner can decide it, with an account key; delegated agent keys are refused, so the assistant can't approve its own request. Anyone can check the signed decision free with verify_human_approval, including that the action matches what was approved.
- It doesn't check your server version, resolve broker endpoints, see the credentials or stop a call your client sends straight to the MQ server. It only covers calls your agent or harness routes through it first, so upgrade and rotate credentials as well.
Rightshold isn't affiliated with AWS. It doesn't scan MCP server code or broker settings, and an approval record isn't a finding that a connection is safe. Advisory details are as published by AWS in GitHub's advisory database (GHSA-xwj6-8x5h-hjp6), the fix and current tool code as shown in the awslabs/mcp repository, and release dates as listed on PyPI, all read November 14, 2026; advisories get updated, so confirm fixed versions on the linked pages.
What are the sources?
- GitHub Advisory: GHSA-xwj6-8x5h-hjp6 / CVE-2026-18655, Amazon MQ MCP Server credential and token disclosure via prompt injection
- awslabs/mcp fix commit 947217066b: replace broker_hostname with broker_id lookup via DescribeBroker API
- awslabs/mcp: Amazon MQ MCP server README
- PyPI: awslabs.amazon-mq-mcp-server release history
Related
- Blocking SSRF and path traversal in MCP tool URL arguments and resource templates
- Stopping prompt injection in fetched web and file content from triggering MCP write tools
- Keeping API keys and tokens out of mcp.json and claude_desktop_config.json
- Require human confirmation before MCP write tools run
Not legal advice. JSON · Markdown · All answers
Get a free API key in one call
No card and no email needed. 100 free credits; the license and policy checks stay free without a key.
curl -s -X POST https://www.rightshold.com/v1/accounts/signup -H "Content-Type: application/json" -d '{"accept_terms":true}'
export RIGHTSHOLD_API_KEY=rs_... # the api_key from the reply (shown once)
curl -s https://www.rightshold.com/v1/licenses/check -H "Authorization: Bearer $RIGHTSHOLD_API_KEY" \
-H "Content-Type: application/json" -d '{"license":"MIT","intended_use":{"commercial_use":true}}'