MEDIUM 5.7 NVD
CVE-2026-18954
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perfo
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.
To remediate this issue, users should upgrade to version 1.0.12 or later.
References
- https://aws.amazon.com/security/security-bulletins/2026-076-aws/
- https://github.com/awslabs/mcp/releases/tag/2026.04.20260408085348
This medium severity vulnerability with a CVSS score of 5.7 was published on 2026-08-05 via NVD.
vulnfeed aggregates 9344 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.