Vulnerabilities CVE-2026-18954

CVE-2026-18954

Medium

Open

TLP:CLEAR

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.

Details

CVSS Score: 5.5
EPSS Score ⓘ: 0.11%

1.4th percentile
CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Confidence: 90%
Published: Aug 5, 2026
Last Modified: Aug 6, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.