CVE-2026-18954
Received Received - Intake

Authorization Bypass in AWS Labs DocumentDB MCP Server

Publication date: 2026-08-05

Last updated on: 2026-08-05

Assigner: AMZN

Description
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-05
Last Modified
2026-08-05
Generated
2026-08-06
AI Q&A
2026-08-05
EPSS Evaluated
N/A
NVD
CVE-2026-18954
EUVD
EUVD-2026-53609

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
amazon aws_labs_documentdb_mcp_server 1.0.12
awslabs mcp 2026.04.20260408085348

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-863 The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-18954 is an incorrect authorization vulnerability in Amazon AWS Labs DocumentDB MCP Server's aggregation pipeline tool. It allows authenticated MCP clients to bypass read-only mode enforcement and perform unauthorized write operations on the connected database using stages like $out and $merge.

Detection Guidance

Detecting this vulnerability requires checking the version of the Amazon AWS Labs DocumentDB MCP Server. If the version is below 1.0.12, the system is vulnerable. Use commands like 'mcp-server --version' or check installed packages for the DocumentDB MCP Server version.

Impact Analysis

This vulnerability could allow an attacker with access to perform unauthorized write operations on your database, potentially altering or deleting data. This may lead to data corruption, loss of integrity, or unauthorized modifications to sensitive information.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strict access controls and data integrity, such as GDPR's data protection principles or HIPAA's safeguards for protected health information. Unauthorized write access risks breaches of confidentiality and integrity.

Mitigation Strategies

Immediately upgrade the Amazon AWS Labs DocumentDB MCP Server to version 1.0.12 or later. As a temporary workaround, configure the MCP server with read-only database credentials to enforce access restrictions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-18954. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart