VULNERABILITY INTELLIGENCE

CVE-2026-18954

CVSS score5.5 MEDIUM
EPSS probability0.16%
CISA KEVNot currently listed
Published2026-08-05
Last modified2026-10-23
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Description

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.

Weakness classification

  • ff89ba41-3aa1-4d27-914a-91399e9639e5: CWE-863

Primary references