5.7
CVE-2026-18954
- EPSS 0.11%
- Veröffentlicht 05.08.2026 20:07:35
- Zuletzt bearbeitet 10.08.2026 15:23:15
- CVE-Watchlists
- Unerledigt
LoginIncorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic. To remediate this issue, users should upgrade to version 1.0.12 or later.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Amazon ≫ Documentdb Mcp Server SwPlatformpython Version < 1.0.12
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.11% | 0.014 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| ff89ba41-3aa1-4d27-914a-91399e9639e5 | 5.7 | 0 | 0 |
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
|
| ff89ba41-3aa1-4d27-914a-91399e9639e5 | 5.5 | 1.8 | 3.6 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
https://github.com/awslabs/mcp/releases/tag/2026.04.20260408085348
https://aws.amazon.com/security/security-bulletins/2026-076-aws/
https://github.com/awslabs/mcp/security/advisories/GHSA-j694-4m5j-w8hc