Threat · curated 8 Aug 2026
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server · Advisory · awslabs/mcp
First reported github.com
Coverage timeline
Single-source advisory — first reported, latest, and curated coincide.
Why it matters
MCP servers that expose databases to AI assistants are trusted to enforce read-only safety boundaries, and this flaw shows how an agent or client can silently write to the backing database despite that configuration, undermining a control operators rely on.
A vulnerability (CVE-2026-18954, GHSA-j694-4m5j-w8hc) in Amazon AWS Labs DocumentDB MCP Server lets an authenticated MCP client bypass read-only mode enforcement by submitting aggregation pipelines with write-capable stages ($out, $merge) through the aggregate tool, which fails to validate pipeline stages. The issue is fixed in version 1.0.12; a workaround is to configure the server with a read-only database user.