Medium nvd · CVE-2026-18954

CVE-2026-18954: Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might al

Published Aug 5, 2026 CVSS 5.7

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.

To remediate this issue, users should upgrade to version 1.0.12 or later.

Agentic / MCP

Affected AI Products

mcp server

View original source

Get the weekly digest. Every Monday: top AI security stories of the week. Free.