CVE-2026-18954: AWS DocumentDB MCP Auth Bypass Flaw

CVE-2026-18954 Overview

CVE-2026-18954 is an incorrect authorization vulnerability [CWE-863] in the Amazon AWS Labs DocumentDB Model Context Protocol (MCP) Server before version 1.0.12. The flaw resides in the aggregation pipeline tool, where write-capable aggregation pipeline stages bypass read-only mode enforcement logic. An authenticated MCP client can perform unauthorized write operations on the connected DocumentDB instance even when the server is configured for read-only access. AWS assigned a CVSS 4.0 base score of 5.7 (Medium), reflecting local attack vector and high integrity impact. Users must upgrade to version 1.0.12 or later to remediate.

Critical Impact
Authenticated MCP clients can bypass read-only mode enforcement and execute inappropriate write operations against connected DocumentDB databases through write-capable aggregation pipeline stages.

Affected Products

Amazon AWS Labs DocumentDB MCP Server versions prior to 1.0.12
Deployments exposing the aggregation pipeline tool to MCP clients
Environments relying on read-only mode enforcement for data integrity

Discovery Timeline

2026-08-05 - CVE-2026-18954 published to NVD
2026-08-05 - Last updated in NVD database

Technical Details for CVE-2026-18954

Vulnerability Analysis

The DocumentDB MCP Server exposes an aggregation pipeline tool that allows MCP clients to run MongoDB-style aggregation queries against a connected DocumentDB instance. Aggregation pipelines in MongoDB-compatible databases support stages that are inherently write-capable, such as $out, $merge, and $emit. These stages persist pipeline results back into collections, effectively producing writes even though the caller invoked what appears to be a query tool.

The read-only mode enforcement logic in versions before 1.0.12 filters requests at the tool boundary but does not inspect individual pipeline stages. As a result, an authenticated client operating under a read-only configuration can smuggle write operations by embedding write-capable stages inside an aggregation request. The CVSS 4.0 vector indicates high integrity impact with no confidentiality or availability effect.

Root Cause

The root cause is incomplete authorization checking [CWE-863]. The server evaluates the tool name against the read-only policy but does not enumerate aggregation pipeline stages against an allow-list of read-only operators. Any pipeline containing a write-capable stage passes the authorization gate.

Attack Vector

Exploitation requires local access with low privileges and an authenticated MCP session. The attacker submits a crafted aggregation pipeline containing a terminal write stage such as $out or $merge. The server forwards the pipeline to DocumentDB, which executes all stages including the write, mutating collections the client should not be able to modify. No user interaction is required. See the AWS Security Bulletin 2026-076 and the GitHub release note for vendor details.

Detection Methods for CVE-2026-18954

Indicators of Compromise

Unexpected new or modified collections in DocumentDB following MCP client sessions authenticated in read-only mode
DocumentDB audit log entries showing $out or $merge stages executed by MCP server service accounts
MCP server logs recording aggregation pipeline invocations from clients that should be restricted to read operations

Detection Strategies

Enable DocumentDB profiler and audit logging to capture full aggregation pipelines submitted by the MCP server
Alert on aggregation requests containing write-capable stages ($out, $merge) when the MCP server is deployed in read-only mode
Correlate MCP session identifiers with resulting database mutations to identify authorization bypass patterns

Monitoring Recommendations

Ingest DocumentDB audit logs and MCP server logs into a centralized analytics platform for correlation
Baseline the set of collections written to by the MCP service account and alert on deviations
Monitor the AWS Labs MCP repository for advisory updates and version releases

How to Mitigate CVE-2026-18954

Immediate Actions Required

Upgrade the DocumentDB MCP Server to version 1.0.12 or later as directed by AWS
Inventory all deployments of the AWS Labs MCP Server and confirm the running version
Rotate any DocumentDB credentials that may have been used through vulnerable server instances
Review DocumentDB audit logs for evidence of unauthorized write activity during the exposure window

Patch Information

AWS Labs released the fix in DocumentDB MCP Server version 1.0.12. Refer to the GitHub Release Note for MCP and the AWS Security Bulletin 2026-076 for release artifacts and remediation guidance.

Workarounds

Restrict MCP server database credentials to accounts with read-only permissions enforced by DocumentDB itself, rather than relying on the MCP server's read-only mode
Limit MCP client access to trusted local users until the upgrade to 1.0.12 is complete
Disable the aggregation pipeline tool exposure where operationally feasible until patching is verified

bash

# Upgrade the AWS Labs DocumentDB MCP Server to the fixed version
pip install --upgrade 'awslabs.documentdb-mcp-server>=1.0.12'

# Verify installed version
pip show awslabs.documentdb-mcp-server | grep -i version