| Titel | cosmicstack-labs mercury-agent 1.1.12 Improper Authorization (CWE-285) |
|---|
| Beschreibung | # Technical Details
An Improper Authorization vulnerability exists in Mercury's sub-agent execution path. The `delegate_task` tool accepts an `allowedTools` array (e.g., `['read_file']`) and forwards it into sub-agent creation, creating the expectation of a narrowed capability set. However, at execution time in `src/core/sub-agent.ts`, `SubAgent.run()` always passes the full registry returned by `this.capabilities.getTools()` into the AI SDK loop, ignoring the `allowedTools` restriction. The registry includes orchestration tools (`list_agents`, `stop_agent`) whenever a supervisor exists. Additionally, `stop_agent` in `src/capabilities/subagents/stop-agent.ts` halts any target via `supervisor.halt(agentId)` without checking ownership or allowed-tool constraints.
# Vulnerable Code
File: src/core/sub-agent.ts (lines 167-173)
Method: SubAgent.run()
Why: The child execution loop always receives the full `capabilities.getTools()` registry, ignoring the declared `allowedTools` restriction.
File: src/capabilities/registry.ts (lines 241-245)
Method: CapabilityRegistry constructor
Why: Registry exposes `delegate_task`, `list_agents`, and `stop_agent` whenever a supervisor is present, making orchestration tools available to restricted children.
File: src/capabilities/subagents/stop-agent.ts (lines 13-27)
Method: createStopAgentTool()
Why: `stop_agent` halts the requested target via `supervisor.halt(agentId)` without checking whether the caller owns or is allowed to control that target agent.
# Reproduction
1. Deploy Mercury with sub-agent delegation enabled.
2. Create a restricted child sub-agent with `allowedTools=['read_file']`.
3. Observe the child still receives `list_agents` and `stop_agent` in its tool registry.
4. The child uses `list_agents` to identify a sibling, then halts it via `stop_agent`.
5. Confirm the control case (benign child) performs only `read_file` without halting siblings.
# Impact
- Authorization and privilege-scope bypass in delegated sub-agent orchestration.
- Restricted child agents can enumerate and halt sibling sub-agents.
- Invalidates the security assumption that `allowedTools` meaningfully constrains delegated workers. |
|---|
| Quelle | ⚠️ https://github.com/cosmicstack-labs/mercury-agent/issues/74 |
|---|
| Benutzer | ChenMarry (UID 99089) |
|---|
| Einreichung | 18.06.2026 09:37 (vor 2 Monaten) |
|---|
| Moderieren | 05.08.2026 21:42 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 386381 [cosmicstack-labs mercury-agent bis 1.1.12 delegate_task Tool src/core/sub-agent.ts SubAgent.run erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|