CVE-2026-90810: Mercury-Agent Authorization Bypass Vulnerability

CVE-2026-90810 Overview

CVE-2026-90810 is an improper authorization vulnerability [CWE-266] in cosmicstack-labs mercury-agent versions up to 1.1.13. The flaw resides in the PermissionManager.checkShellCommand function within mercury-agent/src/capabilities/permissions.ts, part of the Shell Command Permission Check component. An authenticated remote attacker can manipulate the check to bypass intended shell command restrictions. Public exploit code has been released, and the maintainers have not yet responded to an early issue report filed against the project.

Critical Impact
Attackers with low-privilege network access can bypass shell command authorization in mercury-agent, leading to limited confidentiality, integrity, and availability impact on the affected host.

Affected Products

cosmicstack-labs mercury-agent versions up to and including 1.1.13
Component: Shell Command Permission Check (permissions.ts)
Function: PermissionManager.checkShellCommand

Discovery Timeline

2026-09-14 - CVE-2026-90810 published to NVD
2026-09-15 - Last updated in NVD database

Technical Details for CVE-2026-90810

Vulnerability Analysis

The vulnerability lives in the PermissionManager.checkShellCommand routine that governs whether a requested shell command may execute through mercury-agent. The function does not correctly enforce the intended permission model, allowing a caller with low privileges to submit crafted input that the check treats as authorized. Because mercury-agent exposes this capability over the network, exploitation does not require local access. The CWE-266 classification indicates the root issue is incorrect privilege assignment rather than a memory-safety flaw. Impact is bounded to the scope of what the agent can already do on the host, but any bypass of a shell-command gate is meaningful because it collapses the boundary between low-privilege callers and command execution logic.

Root Cause

The root cause is improper authorization logic inside checkShellCommand. The function's decision path does not fully validate the caller's permissions against the requested command, letting requests that should be denied return an allow result. Because the check is the sole gate for shell command execution in the affected component, any logical gap directly translates into unauthorized command handling.

Attack Vector

An attacker reaches mercury-agent over the network and authenticates with low-level privileges already granted to the caller. The attacker then submits a shell command request crafted to exercise the flawed branch in checkShellCommand. The permission manager returns an allow decision for a command the policy intended to block, giving the attacker access to functionality outside their authorization boundary. A public exploit is available, which lowers the operational cost of abuse.

No verified proof-of-concept code is reproduced here. Refer to the GitHub Issue #101 Discussion and the VulDB CVE-2026-90810 Entry for exploit details and reproduction context.

Detection Methods for CVE-2026-90810

Indicators of Compromise

Unexpected shell command execution requests reaching mercury-agent from accounts that should not hold that capability.
Log entries from PermissionManager.checkShellCommand where allow decisions correspond to commands outside the caller's policy scope.
Spawned child processes under the mercury-agent runtime that do not match approved automation workloads.

Detection Strategies

Instrument permissions.ts with verbose audit logging around every checkShellCommand decision, including caller identity, requested command, and allow/deny outcome.
Baseline the set of commands each authenticated principal is expected to invoke, and alert on deviations.
Correlate mercury-agent process-creation telemetry with the agent's own permission decisions to surface mismatches.

Monitoring Recommendations

Forward mercury-agent audit logs to a centralized analytics pipeline for retention and query.
Monitor network exposure of the agent's API and alert on new inbound sources.
Track upstream activity on the GitHub Mercury-Agent Repository for a fixed release.

How to Mitigate CVE-2026-90810

Immediate Actions Required

Inventory all hosts running mercury-agent at version 1.1.13 or earlier and restrict network reachability to trusted management sources.
Rotate or revoke low-privilege credentials that can authenticate to the agent until a patched version is available.
Disable the Shell Command Permission Check code path where the deployment does not require remote shell command execution.

Patch Information

No vendor patch is available at the time of publication. The project maintainers had not responded to the early issue report as of the NVD publication date. Track the GitHub Mercury-Agent Repository and GitHub Issue #101 Discussion for fix status.

Workarounds

Place mercury-agent behind a network policy that restricts inbound traffic to a small allowlist of administrative hosts.
Enforce least-privilege on all accounts authorized to call the agent to reduce the population of potential attackers.
Wrap or replace PermissionManager.checkShellCommand locally with a strict deny-by-default policy for shell command requests until an upstream fix is released.
Where feasible, run mercury-agent under a dedicated unprivileged system account with a constrained command allowlist enforced by the operating system.

bash

# Configuration example: restrict mercury-agent exposure with host firewall (Linux, nftables)
nft add table inet mercury_filter
nft add chain inet mercury_filter input { type filter hook input priority 0 \; policy drop \; }
nft add rule inet mercury_filter input ip saddr 10.0.0.0/24 tcp dport 8443 accept
nft add rule inet mercury_filter input tcp dport 8443 drop