Is there a patch available for CVE-2026-18954?

Yes, a patch is available for CVE-2026-18954. Update the affected software to the latest version immediately.

DocumentDB MCP Server CVE-2026-18954

Q: What is the CVSS score of CVE-2026-18954?

CVE-2026-18954 has a CVSS 4.0 base score of 5.7 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-53609 MEDIUM

Incorrect Authorization (CWE-863)

2026-08-05 ff89ba41-3aa1-4d27-914a-91399e9639e5

GHSA-w95p-h69m-853r

Authentication Bypass Amazon Documentdb Mcp Server

5.7

CVSS 4.0 · Vendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Severity by source

Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5) PRIMARY

5.7 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local MCP client access (AV:L) with low privileges (PR:L); only database integrity impacted (I:H), no confidentiality or availability loss.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (ff89ba41-3aa1-4d27-914a-91399e9639e5).

CVSS VectorVendor: ff89ba41-3aa1-4d27-914a-91399e9639e5

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Aug 05, 2026 - 21:03 EUVD

Source Code Evidence Fetched

Aug 05, 2026 - 20:36 vuln.today

Analysis Generated

Aug 05, 2026 - 20:36 vuln.today

DescriptionCVE.org

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.

To remediate this issue, users should upgrade to version 1.0.12 or later.

AnalysisAI

Write operation bypass in the AWS Labs DocumentDB MCP Server before version 1.0.12 allows an authenticated MCP client to execute unauthorized database writes while the server operates in read-only mode. The aggregation pipeline tool failed to block write-capable stages - specifically $out and $merge - enabling low-privilege MCP clients to modify DocumentDB data in direct violation of the configured read-only policy. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-confirmed fix is available in release 2026.04.20260408085348.

Technical ContextAI

The AWS Labs DocumentDB MCP Server is a Model Context Protocol (MCP) server that exposes Amazon DocumentDB (MongoDB-compatible) operations to AI agents and MCP-compatible tooling. Its aggregation pipeline tool allows clients to execute MongoDB aggregation queries. The root cause is CWE-863 (Incorrect Authorization): the read-only mode enforcement logic failed to inspect or reject write-capable aggregation stages. The $out stage writes pipeline output directly to a named collection, and $merge merges pipeline results into an existing collection - both produce persistent database side effects. These stages should have been denied when read-only mode was active. The CVSS 4.0 vector (AV:L/AT:P) confirms the attack is local with specific attack prerequisites; the GitHub fix commit 'block $out and $merge stages in read-only mode' from @mehulj94 in PR #2862 provides direct source-level confirmation of the precise failure point.

RemediationAI

Upgrade the DocumentDB MCP Server to version 1.0.12 or later, released as part of monorepo tag 2026.04.20260408085348 at https://github.com/awslabs/mcp/releases/tag/2026.04.20260408085348; the vendor advisory at https://aws.amazon.com/security/security-bulletins/2026-076-aws/ confirms this as the primary fix. As a compensating control prior to patching, operators may restrict or disable MCP client access to the aggregation pipeline tool entirely, which eliminates the attack surface but also blocks legitimate analytics workloads. Alternatively, a network or application-layer filter rejecting aggregation queries containing $out or $merge keywords can reduce exposure, though this is a fragile heuristic and does not substitute for the code-level fix.