What is CVE-2026-18655?

CVE-2026-18655 is a medium-severity vulnerability in AWS Amazon-Mq-Mcp-Server, classified under CWE-923. CVSS score: 6.5/10. Published 2026-08-03.

How severe is CVE-2026-18655?

Medium severity. CVSS v3 base score is 6.5 out of 10.

Vulnerability in AWS Amazon-Mq-Mcp-Server

CVE-2026-18655

Improper restriction of intended endpoints in the RabbitMQ broker connection tools of the Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before 2.0.24 may allow a remote unauthenticated actor (via prompt injection) to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens sent to a crafted endpoint controlled through a broker hostname introduced in the MCP client context. To remediate this issue, users should upgrade to version 2.0.24.

EPSS: 0.003 (16.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.

Affected products

Aws Amazon-mq-mcp-server — versions 0

Weakness classification (CWE)

CWE-923

References

ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes, patch)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (vendor-advisory)
ff89ba41-3aa1-4d27-914a-91399e9639e5 (release-notes)

Frequently asked questions

What is CVE-2026-18655?: CVE-2026-18655 is a medium-severity vulnerability in AWS Amazon-Mq-Mcp-Server, classified under CWE-923. CVSS score: 6.5/10. Published 2026-08-03.
How severe is CVE-2026-18655?: Medium severity. CVSS v3 base score is 6.5 out of 10.