CVE-2026-18954: Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.
To remediate this issue, users should upgrade to version 1.0.12 or later.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Amazon AWS Labs DocumentDB MCP Serverto a version that resolves this vulnerability.Fixed in 1.0.12
Event History
Frequently Asked Questions
What is the severity of CVE-2026-18954?
CVE-2026-18954 has a medium severity rating of 5.5.
How do I fix CVE-2026-18954?
To fix CVE-2026-18954, upgrade to version 1.0.12 or later of the Amazon AWS Labs DocumentDB MCP Server.
What does CVE-2026-18954 affect?
CVE-2026-18954 affects the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server.
What type of attacks does CVE-2026-18954 allow?
CVE-2026-18954 allows authenticated MCP clients to perform inappropriate write operations on the connected database.
Is CVE-2026-18954 related to unauthorized data access?
Yes, CVE-2026-18954 involves incorrect authorization that can lead to unauthorized write operations.