Amazon MQ MCP Server Credential Exfiltration via Broker Hostname Prompt Injection

Technical Analysis

The MCP server's RabbitMQ broker connection tool insufficiently validates or restricts the broker hostname/endpoint that gets used when the MCP client establishes a connection. An attacker can inject content (via prompt injection into the MCP client context, e.g., through untrusted tool output, document content, or conversational input) that causes the agent to substitute a malicious hostname for the intended broker endpoint. When the connection tool executes, it sends broker credentials or OAuth access tokens intended for the legitimate Amazon MQ broker to the attacker-controlled endpoint instead. This crosses the trust boundary between the LLM's interpreted intent and the tool's execution layer, since the tool does not independently verify that the destination host matches an authorized/allow-listed broker, effectively turning a credential-carrying connection tool into a covert exfiltration channel.

Affected Systems

awslabs.amazon-mq-mcp-server; protocols: MCP

Detection Signatures

• Outbound connections from MCP server processes to non-allowlisted RabbitMQ/AMQP hostnames or IPs
• Tool invocation logs showing broker hostname parameter values differing from configured/expected endpoint
• Unexpected OAuth token or credential transmission events correlated with MCP tool calls
• MCP client context containing unusual or externally-sourced strings resembling hostnames/URIs immediately preceding broker connection tool calls
• DNS queries to newly registered or suspicious domains originating from MCP server hosts

Remediation Steps

1. 1

   Upgrade the MCP server

   Update awslabs.amazon-mq-mcp-server to version 2.0.24 or later, which restricts allowed broker endpoints.

2. 2

   Enforce endpoint allow-listing

   Configure the MCP server/tool to only permit connections to a fixed, pre-approved set of broker hostnames, rejecting any hostname supplied via untrusted or dynamic context.

3. 3

   Sanitize and validate MCP context inputs

   Treat all hostname/endpoint values sourced from LLM context or tool outputs as untrusted; validate against a strict schema before use in connection tools.

4. 4

   Isolate credential handling

   Avoid passing raw broker credentials or OAuth tokens through paths that can be influenced by LLM-generated or injected content; use short-lived, scoped tokens.

5. 5

   Monitor egress traffic

   Implement network egress monitoring/alerting for MCP server hosts to detect connections to unexpected destinations.