CVE-2026-18954: Authorization Bypass in AWS DocumentDB MCP Server Aggregation Pipeline

Vulnerability Overview Vulnerability Name: Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server CVE ID: CVE-2026-18954 CVSS v3 base metrics: - Attack vector: Local - Attack complexity: Low - Privileges required: Low - User interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: High - Availability: None - CVSS 3.1AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N Severity: Moderate (5.5 / 10) Affected Versions Affected Versions: < 1.0.12 Description: Amazon DocumentDB MCP Server is an open-source Model Context Protocol (MCP) server that enables AI assistants to interact with Amazon DocumentDB databases. In certain scenarios, authenticated MCP clients can bypass the read-only enforcement of the aggregation tool by utilizing write-capable aggregation pipeline stages ( , ). Impact: When the server is configured in the default read-only mode, write operations (inserts, updates, deletes) correctly reject modification requests. However, the aggregation tool does not validate write stages. Authenticated MCP clients can submit aggregation pipelines containing or stages, which perform write operations on the connected database, despite the server being in read-only mode. This bypasses the documented security boundaries that operators rely on when deploying the MCP server. Remediation Fixed Version: 1.0.12 Recommendation: Upgrade to the latest version and ensure that any derived code includes the new fix. Workaround: Configure the MCP server to use database credentials with read-only access (i.e., a user without database-level write permissions). This enforces read-only access regardless of the MCP server configuration. References For any questions or comments, please contact AWS Security via the vulnerability reporting page or directly by email at aws-security@amazon.com. Please do not create public GitHub issues.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-18954: Authorization Bypass in AWS DocumentDB MCP Server Aggregation Pipeline

More from this source