CVE-2026-18998 in mercury-agent
Summary
by MITRE • 08/06/2026
A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in cosmicstack-labs mercury-agent version 1.1.12 represents a critical authorization flaw within the delegate_task tool component, specifically affecting the SubAgent.run function located in src/core/sub-agent.ts. This issue creates a path for unauthorized access through improper privilege management during task execution processes, potentially allowing attackers to bypass intended security controls and gain elevated system access. The vulnerability's exposure occurs during normal operational procedures when the agent processes delegated tasks, making it particularly dangerous as it can be exploited without requiring physical access or specialized privileges.
The technical implementation of this flaw stems from inadequate input validation and authorization checks within the sub-agent execution framework. When the SubAgent.run function processes incoming task requests, it fails to properly verify the authenticity and authorization level of the requesting entity before executing operations. This creates a scenario where malicious actors can manipulate the function parameters or injection points to execute unauthorized commands or access restricted functionalities. The vulnerability's remote exploit capability means attackers can leverage this flaw from external networks without requiring local system access, significantly expanding the attack surface and potential impact. According to CWE classification, this represents a weakness in authorization mechanisms (CWE-285) combined with improper input validation issues.
The operational impact of this vulnerability extends beyond simple unauthorized access, as it can enable attackers to escalate privileges and potentially compromise entire systems managed by the mercury-agent. Remote exploitation capabilities mean that threat actors can target installations from anywhere on the internet, making this vulnerability particularly dangerous for organizations relying on distributed monitoring or management solutions. The fact that an exploit has been publicly disclosed increases the risk profile significantly, as it provides adversaries with ready-made tools and techniques to leverage this weakness. Organizations using this software may face unauthorized data access, system compromise, or potential lateral movement within their networks once attackers successfully exploit this authorization bypass.
Mitigation strategies should focus on immediate patching of the mercury-agent component to version 1.1.13 or later where the authorization flaw has been addressed through proper input validation and privilege checking mechanisms. Network segmentation and firewall rules should be implemented to limit access to affected systems, particularly restricting remote access to ports used by the mercury-agent service. Organizations should conduct comprehensive vulnerability assessments to identify all systems running impacted versions and implement monitoring for suspicious activities related to task execution or authorization requests. Additionally, implementing principle of least privilege controls and regular security audits can help reduce the potential damage from successful exploitation attempts. The ATT&CK framework suggests this vulnerability could be categorized under privilege escalation techniques (T1068) and defense evasion tactics (T1070), indicating that organizations need to prepare for both unauthorized access and subsequent malicious activities that may follow exploitation of this authorization bypass flaw.