CVE-2026-18997 Overview
CVE-2026-18997 is an incorrect authorization vulnerability [CWE-285] in cosmicstack-labs mercury-agent versions up to 1.1.12. The flaw resides in the Agent.handleBgCommand function within src/core/agent.ts, part of the bg command handler component. An attacker with low-level privileges can manipulate input to the handler and bypass intended authorization checks over the network. The exploit has been publicly disclosed, and the project maintainers have not yet responded to the issue report. Because the weakness is remotely reachable and exploit details are public, exposed deployments should be reviewed for unauthorized use of background command functionality.
Critical Impact
Authenticated remote attackers can bypass authorization checks in the bg command handler, resulting in limited unauthorized read, modification, and availability impact on affected mercury-agent instances.
Affected Products
- cosmicstack-labs mercury-agent versions up to and including 1.1.12
- Component: bg Command Handler
- Affected function: Agent.handleBgCommand in src/core/agent.ts
Discovery Timeline
- 2026-08-06 - CVE-2026-18997 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18997
Vulnerability Analysis
The vulnerability affects the Agent.handleBgCommand function in src/core/agent.ts, which processes background (bg) commands submitted to the agent. The handler performs incorrect authorization when validating requests, allowing an authenticated user with low privileges to invoke operations that should be restricted. The issue is classified under CWE-285: Improper Authorization. Because mercury-agent accepts commands over the network, exploitation does not require local access. Public exploit details raise the likelihood of opportunistic abuse against internet-reachable or lab deployments. Detailed technical write-ups are available in the VulDB CVE-2026-18997 Details entry and the GitHub Issue #73 for Mercury Agent.
Root Cause
The root cause is missing or incorrect authorization logic within Agent.handleBgCommand. The function does not adequately verify that the calling principal is entitled to execute the requested background command before dispatching it. This gap allows privilege boundaries enforced elsewhere in the agent to be bypassed through the bg command path.
Attack Vector
An attacker with valid low-privilege credentials sends a crafted bg command request to a reachable mercury-agent instance. Because the handler fails to enforce the correct authorization decision, the request is executed with broader capability than intended. No user interaction is required, and the attack can be conducted remotely against any network-exposed agent instance. Concrete reproduction steps are referenced in the GitHub Repository for Mercury Agent issue tracker.
Detection Methods for CVE-2026-18997
Indicators of Compromise
- Unexpected background command execution events originating from low-privilege accounts in mercury-agent logs.
- Requests to the bg command handler from unusual source IP addresses or during off-hours.
- Agent process activity that does not correlate with legitimate scheduled work or authorized operators.
Detection Strategies
- Instrument Agent.handleBgCommand with verbose audit logging that captures caller identity, authorization decision, and command payload.
- Alert on any bg command executed by an account that has not previously used background command features.
- Correlate agent command telemetry with identity and session data to identify authorization decisions that deviate from role expectations.
Monitoring Recommendations
- Forward mercury-agent logs to a centralized SIEM and build a rule that flags authorization anomalies on the bg command path.
- Monitor outbound activity from hosts running mercury-agent for signs of follow-on actions after successful command dispatch.
- Track version inventory to identify any mercury-agent instances still running 1.1.12 or earlier.
How to Mitigate CVE-2026-18997
Immediate Actions Required
- Inventory all hosts running mercury-agent and identify instances at version 1.1.12 or below.
- Restrict network access to mercury-agent endpoints so only trusted management systems can reach the command interface.
- Rotate and tighten credentials used with mercury-agent, minimizing accounts that hold bg command privileges.
- Review historical logs for prior invocations of the bg command handler by non-administrative principals.
Patch Information
No vendor patch has been published at the time of writing. The project was notified through GitHub Issue #73 for Mercury Agent but has not responded. Track the GitHub Repository for Mercury Agent for a fixed release and the VulDB Vulnerability #386380 entry for updated remediation guidance.
Workarounds
- Disable or remove the bg command handler in deployments where background command execution is not required.
- Place mercury-agent behind a reverse proxy or firewall that enforces authorization at the network layer before requests reach the handler.
- Limit mercury-agent accounts to the minimum privilege set and prohibit shared credentials until a patched release is available.
- Apply a local patch to Agent.handleBgCommand in src/core/agent.ts that verifies caller privileges before dispatching background commands, if operating a forked build.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
