Three AWS Security Flaws Expose AI Agents, Amazon MQ Credentials and EMR SSH Connections

Amazon Web Services has released security updates for three vulnerabilities affecting the AWS Amazon MQ MCP Server, AWS Command Line Interface and Strands Agents Tools. The issues range from credential exposure and weakened SSH protection to a prompt-injection flaw capable of bypassing human approval before operating-system commands are executed.

The vulnerabilities are tracked as CVE-2026-18655, CVE-2026-18654 and CVE-2026-18733. Two are rated High severity, while the AWS CLI issue carries a Medium rating. Together, they demonstrate how security weaknesses can emerge when traditional cloud-management tools are combined with AI agents, automated approvals and privileged command execution.

Why These Vulnerabilities Matter

The affected products perform very different jobs.

The Amazon MQ MCP Server allows AI assistants to interact with Amazon MQ message brokers. The AWS CLI gives administrators and developers command-line access to AWS services. Strands Agents is an open-source software development kit for building AI agents, with optional tools that can execute commands on the system hosting the agent.

Because these components may handle credentials, remote connections or local command execution, a vulnerability can affect more than one application session. Depending on the product, an attacker could redirect sensitive credentials, intercept SSH activity or persuade an AI agent to run commands without receiving the expected human approval.

The most significant lesson is that automation does not remove the need for strict validation. A tool may be designed to help an operator work more efficiently, but every hostname, command and parameter supplied through an automated workflow still needs to be treated as potentially unsafe.

CVE-2026-18655 Could Redirect Amazon MQ Credentials

The first vulnerability, CVE-2026-18655, affects the RabbitMQ connection tools in awslabs.amazon-mq-mcp-server.

The flaw is described as an improper restriction of intended endpoints. The MCP server accepts a broker hostname through the MCP client context, but a specially crafted hostname could direct connection information towards an endpoint controlled by an attacker.

According to the advisory, a remote unauthenticated actor may be able to obtain Amazon MQ for RabbitMQ broker credentials or OAuth access tokens when those secrets are sent to the malicious endpoint.

This vulnerability has a CVSS 4.0 score of 7.1, placing it in the High-severity category.

How the MCP Server Creates Risk

The Model Context Protocol server is intended to let an AI assistant interact with Amazon MQ.

That integration can be useful because the assistant may help initialise broker connections or perform related administrative tasks. However, the AI-driven workflow may receive arguments from prompts, contextual data or other external sources.

If a manipulated broker hostname is accepted without sufficient restriction, the MCP server may connect somewhere other than the legitimate Amazon MQ endpoint. Credentials intended for the trusted broker could then be exposed to infrastructure controlled by an attacker.

The danger is not that Amazon MQ itself necessarily becomes compromised. The weakness exists in how the supporting MCP tool decides where sensitive connection data should be sent.

Auto-Approval Makes the Problem More Dangerous

AWS recommends avoiding automatic approval for the affected RabbitMQ broker initialisation tools until the update has been installed.

Specifically, organisations should not enable auto-approval for:

Requiring manual approval gives the operator an opportunity to inspect the broker_hostname argument and reject requests that do not match the expected Amazon MQ endpoint pattern.

The advisory uses the tool names with the spelling shown above. Administrators should compare them against the names used in their own installation and configuration.

This mitigation highlights an important principle for AI-connected infrastructure: approval prompts only provide protection when a human can clearly see the destination and meaningfully review it before execution.

CVE-2026-18654 Weakens SSH Protection in the AWS CLI

The second vulnerability, CVE-2026-18654, affects several AWS CLI helper commands used with Amazon EMR.

The affected commands are:

The issue causes these commands to disable SSH host-key verification. This could allow a man-in-the-middle attacker positioned between the AWS CLI client and the EMR cluster endpoint to intercept SSH sessions or file transfers.

The vulnerability has a CVSS 4.0 score of 6.8, giving it a Medium-severity rating.

Why SSH Host-Key Verification Is Important

SSH host-key verification helps a client confirm that it is connecting to the intended remote server.

Without that verification, an attacker with the ability to intercept or redirect network traffic may impersonate the destination. The user could believe they are connecting securely to the expected EMR cluster while the session is actually passing through infrastructure controlled by someone else.

The encrypted connection may still exist, but it would be established with the wrong system.

For interactive SSH sessions, that could expose administrative activity or information exchanged during the connection. For the put and get helper commands, it could affect files being transferred between the client and the EMR environment.

There Is No Workaround Beyond Updating the AWS CLI

AWS states that the insecure SSH option was hardcoded and could not be overridden by the user.

As a result, there is no configuration-based workaround for CVE-2026-18654. The only recommended resolution is to upgrade the AWS CLI to a corrected release.

This is an important distinction from the Amazon MQ MCP Server and Strands Agents vulnerabilities, where temporary operational controls can reduce exposure while updates are being deployed.

Organisations using the affected EMR helper commands should therefore prioritise the AWS CLI update rather than relying on command-line flags or local settings to restore host-key checking.

CVE-2026-18733 Can Bypass Human Approval in Strands Agents

The third vulnerability, CVE-2026-18733, affects the shell tool included with strands-agents-tools.

Strands Agents is an open-source SDK for building AI agents. Its accompanying tools package includes a shell capability that can execute operating-system commands on the machine hosting the agent.

Because shell access is highly privileged, the tool normally includes a human consent gate. Before a command runs, the operator is expected to review and approve it.

The vulnerability allows a crafted prompt to set the non_interactive parameter to true, bypassing that approval step. A remote actor could potentially use this behaviour to execute arbitrary operating-system commands on the agent host.

CVE-2026-18733 carries a CVSS 4.0 score of 7.5, making it the highest-scoring of the three vulnerabilities covered by the advisory.

Prompt Injection Becomes More Serious When an Agent Has Shell Access

Prompt injection occurs when untrusted content influences an AI system's instructions or tool use.

In a simple chatbot, a successful injection may cause an incorrect or misleading response. The consequences are much more serious when the AI agent has access to tools capable of changing files, running scripts or issuing operating-system commands.

The shell tool's consent gate is meant to provide a final human checkpoint. Even when an AI agent proposes a dangerous command, the operator should be able to reject it before execution.

CVE-2026-18733 undermines that safety control by allowing the prompt to place the tool into non-interactive operation.

The problem is therefore not only that the AI can be manipulated. It is that the manipulation can bypass the mechanism specifically designed to stop unapproved commands from running.

Untrusted Content Should Not Reach a Shell-Enabled Agent

Until the fixed version is installed, AWS recommends that organisations avoid making the shell tool available to any agent that processes untrusted content.

Where the shell tool must still be used, the agent should run inside an isolated, least-privilege environment so that any executed commands remain contained.

This means the agent should not have unrestricted access to sensitive files, production credentials or critical operating-system functions.

Isolation may reduce the damage if prompt injection succeeds, but it does not repair the underlying vulnerability. The safest response remains upgrading the affected package.

Which Versions Are Affected?

The advisory identifies the following vulnerable versions:

Administrators should verify installed versions directly rather than assuming an automatic package update has already applied the fixes.

Development environments, containers, CI/CD runners and administrator workstations may carry separate copies of these tools and should all be included in the inventory.

Fixed Versions Are Available

AWS recommends upgrading affected installations as soon as possible.

The corrected releases are:

Teams should confirm that dependency-lock files, deployment images and build pipelines reference these fixed versions or newer releases.

Updating a developer's local package alone may not protect a container image or automation runner that continues pulling an older pinned version.

AI Tools Need Traditional Security Controls

Two of the three vulnerabilities affect components used to connect AI systems with external services or operating-system tools.

This reinforces the need to apply familiar security principles to AI agents:

AI-driven workflows may feel conversational, but the underlying activity is still software execution.

A natural-language prompt can ultimately cause an HTTP connection, credential transfer or shell command. The security controls protecting those actions must be as strong as they would be in any conventional application.

Human Approval Is Not Enough When It Can Be Bypassed

The Strands Agents issue also raises a broader design concern.

A system may claim that a human remains in control because it displays an approval prompt. That protection is meaningful only when there is no alternate parameter or code path capable of disabling the prompt without trusted authorisation.

Consent controls should be enforced outside the untrusted input path whenever possible. An AI agent should not be able to decide for itself that human approval is no longer required merely because a prompt instructed it to operate non-interactively.

The vulnerability demonstrates why human-in-the-loop systems still require technical enforcement. A visible confirmation screen does not provide genuine security if the agent can be manipulated into skipping it.

Organisations Should Review Where These Components Are Used

The three products may appear in different parts of an organisation.

The AWS CLI may be installed on administrator workstations, automation servers and CI/CD runners. The Amazon MQ MCP Server may be part of an AI-assistant or cloud-operations experiment. Strands Agents Tools may be used by development teams building internal AI agents.

Security teams should therefore coordinate with:

These tools may not all be managed through the same patching process.

AI-related packages are particularly likely to exist in experimental projects or developer environments that are not yet included in the organisation's formal software inventory.

Final Thoughts

The three AWS vulnerabilities show how modern cloud security now extends beyond conventional servers and management consoles.

CVE-2026-18655 could redirect Amazon MQ credentials or OAuth tokens to an attacker-controlled endpoint through a manipulated broker hostname. CVE-2026-18654 weakens SSH host verification in several AWS CLI EMR commands, creating an opportunity for man-in-the-middle interception. CVE-2026-18733 allows crafted prompts to bypass human consent and execute operating-system commands through the Strands Agents shell tool.

Fixed versions are already available, and organisations should upgrade immediately.

Until patching is complete, Amazon MQ MCP Server users should disable auto-approval and manually inspect broker hostnames. Strands Agents deployments should prevent shell access from agents that process untrusted content and should run privileged tools inside isolated, least-privilege environments. The AWS CLI flaw has no workaround other than installing the corrected version.

The wider lesson is straightforward: connecting AI assistants to cloud credentials and shell commands dramatically increases what a malicious prompt or manipulated parameter can achieve.

AI agents should never be trusted simply because their instructions appear in natural language. Every endpoint, approval decision and command must still be validated through enforceable security controls.