What is GHSA-w95p-h69m-853r?

GHSA-w95p-h69m-853r is a security advisory published by GitHub Security Advisories with Medium severity. Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server...

Which CVE IDs does GHSA-w95p-h69m-853r cover?

GHSA-w95p-h69m-853r covers the following CVE IDs: CVE-2026-18954. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-w95p-h69m-853r?

GHSA-w95p-h69m-853r has a CVSS v3 base score of 5.5, published by GitHub Security Advisories.

GHSA-w95p-h69m-853rMediumCVSS 5.5

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server...

Vendor

GitHub Security Advisories

Published

August 5, 2026

Last Modified

August 6, 2026

🔗 CVE IDs covered (1)

CVE-2026-18954 →

📋 Description

Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode enforcement logic.

To remediate this issue, users should upgrade to version 1.0.12 or later.

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-18954
https://aws.amazon.com/security/security-bulletins/2026-076-aws
https://github.com/awslabs/mcp/releases/tag/2026.04.20260408085348
https://github.com/awslabs/mcp/security/advisories/GHSA-j694-4m5j-w8hc
https://github.com/advisories/GHSA-w95p-h69m-853r