AWS Labs Amazon MQ MCP Server (awslabs.amazon-mq-mcp-server) before version 2.0.24 contains an improper restriction of intended endpoints vulnerability in its RabbitMQ broker connection tools. This flaw allows a remote unauthenticated actor to exploit crafted broker hostnames introduced in the MCP client context to capture Amazon MQ RabbitMQ broker credentials or OAuth access tokens sent to attacker-controlled endpoints. The vulnerability affects all versions up to and including 2.0.23. AWS has addressed this issue in version 2.0.24 and recommends upgrading and rotating broker credentials. A temporary workaround is to disable auto-approve for the rabbimq_broker_initialize_connection and rabbimq_broker_initialize_connection_with_oauth tools to enforce manual inspection of broker hostnames.

A remote unauthenticated attacker can obtain sensitive RabbitMQ broker credentials or OAuth access tokens by exploiting the improper endpoint restrictions in the affected versions of the Amazon MQ MCP Server. This could lead to unauthorized access to Amazon MQ brokers and potentially compromise message broker operations or data confidentiality. The impact is significant because it involves credential and token disclosure without authentication.

An official fix is available in awslabs.amazon-mq-mcp-server version 2.0.24. Users should upgrade to this version promptly and rotate any broker credentials that may have been exposed. As a temporary mitigation before upgrading, disable auto-approve for the rabbimq_broker_initialize_connection and rabbimq_broker_initialize_connection_with_oauth tools to require manual verification of broker hostnames, rejecting any that do not match the expected Amazon MQ endpoint pattern.