CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
Labs ยท 2026-10-21
Actions
Technical Details
| Affected Versions | < 1.0.12 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-18954 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update Amazon DocumentDB MCP Server to version 1.0.12 to address CVE-2026-18954, an incorrect authorization issue that could allow write operations in read-only mode, and configure the server with read-only database credentials as a workaround.
For Platform Teams
Deploy the patched Amazon DocumentDB MCP Server version 1.0.12 to resolve the incorrect authorization vulnerability and maintain secure interactions between AI assistants and DocumentDB databases.
For Executives
Implement the latest Amazon DocumentDB MCP Server version 1.0.12 to mitigate CVE-2026-18954, a critical security vulnerability that could allow unauthorized write operations, ensuring data integrity and compliance.