CVE-2026-18954

MediumCVSS 5.5/10Last modified Oct 23, 2026

Description

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.

To remediate this issue, users should upgrade to version 1.0.12 or later.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 5, 2026
Last modified: Oct 23, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-189575.4Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Menulux Software Inc. Menulux Portal a CVE-2026-189587.3A vulnerability was detected in imranrisal-dev Student-Management-System 18ea7904c339e0c7b0234724a79c939ce6191def/a8d43a29aaf267e7ca97171d6d CVE-2026-189595.4A flaw has been found in yushine InnoShop up to 0.8.2. Affected by this issue is the function FileManagerController::destroyFiles of the fil CVE-2026-18966.3A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file s CVE-2026-189605.4The Block User Account WordPress plugin before 2.0.1 does not enforce its account block on every authentication path, allowing a blocked use CVE-2026-189618.1The Social Login, Passkeys, Magic Link & Email OTP – Passwordless Login by VentraConnect plugin for WordPress is vulnerable to Authenticatio CVE-2026-189624.3The WP Photo Album Plus WordPress plugin before 9.2.09.002 does not check that the current user is allowed to upload into the album they tar CVE-2026-189639.1A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access manageme CVE-2026-189646.1The Floating Chat Widget: Contact Chat Icons, Telegram Chat, Line Messenger, WeChat, Email, SMS, Call Button – Chaty plugin for WordPress is CVE-2026-189658.8PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network t CVE-2026-189678.1A flaw was found in the SAML broker component of Keycloak, an identity and access management solution. When configured as a SAML broker usin CVE-2026-189684.3A security vulnerability has been detected in ttttonyhe OBlog up to 3ca6a45a2fcc81f6086751d8af124658720e8f8f. This issue affects some unknow