CVE-2026-18996 Overview
CVE-2026-18996 affects cosmicstack-labs mercury-agent versions up to 1.1.12. The flaw resides in the PermissionManager.checkShellCommand function inside src/capabilities/permissions.ts, part of the run_command handler. The weakness maps to [CWE-266: Incorrect Privilege Assignment]. A remote authenticated attacker with low privileges can leverage the flawed permission check to obtain unintended access. The exploit details have been publicly disclosed. According to the disclosure, the project maintainers were notified through an issue report but have not yet responded.
Critical Impact
Remote authenticated attackers can leverage the flawed permission check in the run_command handler to gain privileges beyond their assigned scope, undermining command execution controls in mercury-agent.
Affected Products
- cosmicstack-labs mercury-agent versions up to and including 1.1.12
- Component: run_command handler
- Affected file: src/capabilities/permissions.ts
Discovery Timeline
- 2026-08-06 - CVE-2026-18996 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18996
Vulnerability Analysis
The vulnerability is an incorrect privilege assignment flaw [CWE-266] in the PermissionManager.checkShellCommand function of mercury-agent. This function is responsible for validating whether a caller is authorized to execute a shell command through the run_command handler. Because the check does not correctly enforce the intended privilege boundary, callers can trigger command execution paths that should be restricted to higher-privileged roles.
The issue is reachable over the network, and the disclosed exploit path requires only low privileges to invoke. The public disclosure of the technique lowers the barrier for opportunistic abuse against exposed mercury-agent instances.
Root Cause
The root cause is a logic error in checkShellCommand within src/capabilities/permissions.ts. The function assigns or evaluates permissions in a way that does not correctly gate the shell command execution flow. As a result, requests that should be denied by policy are treated as authorized, granting the caller effective privileges the design did not intend.
Attack Vector
An attacker interacts with the mercury-agent run_command handler over the network using a low-privileged account. By issuing a crafted command request, the attacker exercises the flawed branch of checkShellCommand and executes actions reserved for higher-privileged principals. No user interaction is required. See the GitHub Issue Discussion and the VulDB CVE Report for additional technical context.
No verified proof-of-concept code is published in the enriched data.
Refer to the linked GitHub issue and VulDB entries for exploitation details.
Detection Methods for CVE-2026-18996
Indicators of Compromise
- Requests to the mercury-agent run_command handler from low-privileged accounts that result in successful execution of privileged shell commands.
- Unexpected shell command activity spawned by the mercury-agent process on hosts running versions up to 1.1.12.
- Access log entries showing repeated calls to endpoints invoking PermissionManager.checkShellCommand prior to sensitive command execution.
Detection Strategies
- Audit mercury-agent application logs for run_command invocations correlated with the account privilege of the caller, and flag mismatches against the intended policy.
- Monitor child processes spawned by mercury-agent for shell commands that fall outside expected operational baselines.
- Correlate authentication events for low-privileged accounts with subsequent privileged command execution on the same host.
Monitoring Recommendations
- Enable verbose audit logging on the mercury-agent host, including process creation and command-line arguments.
- Ingest host and application telemetry into a centralized analytics platform to identify anomalous command execution patterns.
- Alert on any invocation of run_command originating from accounts that lack shell execution entitlement.
How to Mitigate CVE-2026-18996
Immediate Actions Required
- Restrict network access to mercury-agent instances so that only trusted management systems can reach the run_command handler.
- Revoke or tighten low-privilege accounts that can authenticate to mercury-agent until a fix is available.
- Review recent run_command activity for evidence of misuse against versions up to 1.1.12.
Patch Information
At the time of publication, the enriched data indicates the project maintainers were informed through an issue report but have not yet responded. No official patched release is referenced. Track the GitHub Issue Discussion and the upstream cosmicstack-labs mercury-agent repository for a fixed version.
Workarounds
- Place mercury-agent behind a network segmentation boundary or authenticated reverse proxy that enforces stricter authorization.
- Disable or restrict the run_command capability where it is not operationally required.
- Rotate credentials for all accounts able to reach the agent and enforce least privilege on those principals.
# Example: restrict mercury-agent exposure to a trusted management subnet
iptables -A INPUT -p tcp --dport <mercury-agent-port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <mercury-agent-port> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
