CVE-2026-18998 Overview
CVE-2026-18998 is an improper authorization vulnerability [CWE-266] in cosmicstack-labs mercury-agent versions up to 1.1.12. The flaw resides in the SubAgent.run function within src/core/sub-agent.ts, part of the delegate_task tool component. An authenticated remote attacker with low privileges can manipulate the function to perform actions beyond their intended authorization scope. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use. The maintainers were notified through a public issue report but have not responded at the time of publication.
Critical Impact
Remote authenticated attackers can bypass authorization controls in the delegate_task tool, impacting confidentiality, integrity, and availability of the agent runtime.
Affected Products
- cosmicstack-labs mercury-agent versions up to and including 1.1.12
- Component: delegate_task tool
- File: src/core/sub-agent.ts (function SubAgent.run)
Discovery Timeline
- 2026-08-06 - CVE-2026-18998 published to NVD
- 2026-08-06 - Last updated in NVD database
Technical Details for CVE-2026-18998
Vulnerability Analysis
The vulnerability is an improper authorization weakness classified under [CWE-266]. The SubAgent.run function in src/core/sub-agent.ts fails to enforce sufficient authorization checks before executing delegated tasks. When the delegate_task tool is invoked, the sub-agent processes the request without adequately validating whether the caller is authorized to perform the requested operation. This design flaw allows a low-privileged remote user to trigger actions that should require elevated permissions. The public disclosure of exploitation details on the project's GitHub issue tracker and VulDB record makes weaponization trivial for opportunistic actors.
Root Cause
The root cause is missing or insufficient authorization enforcement in the sub-agent task delegation path. SubAgent.run accepts task parameters from the delegate_task tool and executes them without verifying the caller's privilege boundary. The trust model assumes callers of the delegation interface are already authorized for any downstream action, which is not enforced by the code itself.
Attack Vector
An attacker with network access and low-level authenticated privileges sends a crafted request to the mercury-agent invoking the delegate_task tool. Because SubAgent.run does not gate the requested operation against the caller's authorization scope, the sub-agent executes the task with broader permissions than intended. No user interaction is required. See the GitHub Issue Tracker and VulDB Vulnerability Record for public disclosure details.
Detection Methods for CVE-2026-18998
Indicators of Compromise
- Unexpected invocations of the delegate_task tool by low-privilege user accounts or API tokens.
- Sub-agent task execution logs showing operations that exceed the calling identity's normal privilege scope.
- Repeated calls into SubAgent.run from a single source with varied task parameters, indicating probing.
Detection Strategies
- Baseline normal delegate_task usage per identity and alert on deviations in tool invocation patterns.
- Correlate authentication context with downstream sub-agent actions to identify authorization mismatches.
- Ingest mercury-agent runtime logs into a centralized data lake and apply behavioral rules to flag privilege boundary violations.
Monitoring Recommendations
- Enable verbose logging in mercury-agent for all delegate_task and SubAgent.run invocations, including caller identity and requested action.
- Monitor the GitHub PoC Repository and VulDB CVE Listing for patch releases or updated exploit code.
- Alert on outbound network activity or unexpected process spawns originating from the mercury-agent runtime.
How to Mitigate CVE-2026-18998
Immediate Actions Required
- Restrict network exposure of any mercury-agent instance running version 1.1.12 or earlier to trusted networks only.
- Revoke or rotate low-privilege credentials that can reach the delegate_task tool endpoint until a patch is available.
- Audit historical logs for anomalous delegate_task invocations that may indicate prior exploitation.
Patch Information
No vendor patch is available at the time of publication. The maintainers of cosmicstack-labs/mercury-agent were notified through GitHub issue #74 but have not yet responded. Track the GitHub PoC Repository for future releases addressing this issue.
Workarounds
- Place the mercury-agent behind an authenticating reverse proxy that enforces coarse-grained authorization before requests reach SubAgent.run.
- Disable or remove the delegate_task tool from the agent configuration if it is not required for operational use.
- Apply application-layer allow-lists that restrict which identities can invoke sub-agent delegation, compensating for the missing in-code check.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
