🟠 High | Source: AWS Security Bulletins
A flaw in the Amazon DocumentDB MCP Server (versions before 1.0.12) allows authenticated AI assistant clients to perform write operations even when the server is configured in read-only mode. The vulnerability exists because the aggregation pipeline stages $out and $merge bypass the read-only enforcement logic. Any environment using this open-source server to connect AI assistants to DocumentDB databases is potentially at risk of unauthorised data modification.
Security Architect’s Take: Immediately update the Amazon DocumentDB MCP Server to version 1.0.12 or later, and audit recent aggregation pipeline activity in any connected DocumentDB instances for unexpected write operations such as new or modified collections produced by $out or $merge stages.
Original advisory: CVE-2026-18954 - Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server