CVE-2026-18954CWE-863broken-access-control

CVE-2026-18954

Medium · published August 6, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.6
In the wild
Unconfirmed
What it is

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.

To remediate this issue, users should upgrade to version 1.0.12 or later.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00158 · 4.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2026-08-06T00:17Z
Affected products (1)
ProductVersionsFixed in
amazon/documentdb_mcp_server< 1.0.121.0.12
References (3)
https://aws.amazon.com/security/security-bulletins/2026-076-aws/ · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/mcp/releases/tag/2026.04.20260408085348 · ff89ba41-3aa1-4d27-914a-91399e9639e5https://github.com/awslabs/mcp/security/advisories/GHSA-j694-4m5j-w8hc · ff89ba41-3aa1-4d27-914a-91399e9639e5
EPSS history
Timeline
  • 05 AUG 20:07Z
    Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
    cvelistv5