Amazon DocumentDB MCP Server Allows Write Bypass in Read-Only Mode
An authorization flaw in the open-source server lets authenticated clients perform database writes despite read-only settings, per an AWS advisory.
Key points
- CVE-2026-18954 affects the Amazon DocumentDB MCP Server aggregation pipeline tool.
- The bug allows write-capable stages like $out to bypass read-only enforcement logic.
- AWS released version 1.0.12 to address the incorrect authorization issue.
Amazon released an advisory on August 5, 2026, detailing CVE-2026-18954 in the Amazon DocumentDB MCP Server. This open-source tool enables AI assistants to interact with Amazon DocumentDB databases. The vulnerability involves incorrect authorization within the aggregation pipeline tool, specifically affecting how the server handles write operations when configured for read-only access.
Root cause
The issue stems from a logic error in how the server enforces read-only mode. According to the AWS bulletin, write-capable aggregation pipeline stages, including $out and $merge, bypass the enforcement logic. This allows an authenticated MCP client to execute write operations on the connected database even when the server is supposed to restrict such actions.
Attack path
An attacker would need to be an authenticated MCP client connected to the vulnerable server. By constructing an aggregation pipeline that includes stages like $out or $merge, the client can bypass the read-only configuration. This action results in unauthorized write operations being performed on the underlying Amazon DocumentDB database, altering data despite the intended security constraints.
Affected versions
- Amazon DocumentDB MCP Server versions prior to 1.0.12 are affected.
- Forked or derivative codebases that have not incorporated the fix are also vulnerable.
- The issue is resolved in version 1.0.12 of the server software.
Mitigation
- Upgrade to Amazon DocumentDB MCP Server version 1.0.12 immediately.
- Ensure any forked or derivative code is patched with the new fixes.
- Configure the MCP server with database credentials for a read-only user to enforce access control at the database level.
Detection notes
Security teams should monitor database audit logs for unexpected write operations originating from service accounts intended for read-only access. Alert on aggregation pipeline stages such as $out or $merge appearing in traffic from AI assistant interfaces. Verify that database user permissions align with application configuration settings. If anomalies are detected, isolate the affected MCP server instance to prevent further unauthorized data modifications while investigating the source of the requests.
What to do and how to stay safe: Amazon DocumentDB
- Verify your current version of the Amazon DocumentDB MCP Server and upgrade to 1.0.12 if you are running an older build.
- Audit your database user credentials to ensure the MCP server is using an account with strictly read-only permissions.
- Review application logs for any aggregation pipeline commands that perform write actions during periods when the system should be read-only.
- Monitor for new security bulletins from AWS regarding this component or similar open-source tools in your infrastructure.
Step-by-step guide: Unpatched Software Myths: Why Common Beliefs Fail to Protect You
General security guidance from the BlueTeam Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-18954?
It is an incorrect authorization vulnerability in the Amazon DocumentDB MCP Server that allows write operations to bypass read-only mode enforcement.
Which versions are affected?
Versions of the Amazon DocumentDB MCP Server prior to 1.0.12 are affected, as well as unpatched forks or derivative code.
How can I prevent exploitation?
AWS recommends upgrading to version 1.0.12 and configuring the server with database credentials for a read-only user to enforce access controls.
