CVE-2026-18954
Amazon AWS Labs DocumentDB MCP Server
- Severity
- Medium
- Published
- August 5, 2026
- Last modified
- August 10, 2026
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.
CVSS vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Weakness
- CWE-863 Incorrect authorization
References
- aws.amazon.comVendor Advisory
- github.comRelease Notes
- github.comVendor Advisory
Listed in
Related CVEs
The officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and infrastructure/main.bicep to default the apiKey parameter to an empty string and pass it to the App Service…
Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp server, which binds all network interfaces and exposes the /sse and /messages endpoints.
IBM ContextForge MCP Gateway 0.1.0 through 1.0.5 is vulnerable to a server-side request Forgery (SSRF) that allows authenticated users with gateway creation privileges to perform arbitrary HTTP POST…
djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance.
A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.0.
The experimental tasks feature (taskStore) did not check which session created a task.