CVE-2026-90811 Overview
CVE-2026-90811 is an information disclosure vulnerability in cosmicstack-labs mercury-agent versions up to 1.2.0. The flaw resides in the PermissionManager.checkShellCommand function within mercury-agent/src/capabilities/permissions.ts, part of the Shell Permission Manifest component. A local attacker with low privileges can manipulate the permission check to disclose information the manifest is intended to protect. A public exploit exists, and the maintainers were notified through a GitHub issue but have not yet responded. The weakness is classified under CWE-200: Exposure of Sensitive Information to an Unauthorized Actor.
Critical Impact
Local users can trigger the flawed shell permission check to reveal sensitive information handled by mercury-agent, and a public proof of concept is already circulating without a vendor fix.
Affected Products
- cosmicstack-labs mercury-agent 1.0.x
- cosmicstack-labs mercury-agent 1.1.x
- cosmicstack-labs mercury-agent up to and including 1.2.0
Discovery Timeline
- 2026-09-14 - CVE-2026-90811 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-90811
Vulnerability Analysis
The vulnerability sits inside PermissionManager.checkShellCommand, the routine responsible for validating shell commands against the Shell Permission Manifest. Instead of enforcing a strict allow-list boundary, the function leaks state that should remain internal to the permission layer. A local user invoking crafted commands can observe this state and infer information the manifest was designed to protect.
Because the attack surface is local and requires low privileges, exploitation is limited to users who already interact with the mercury-agent process. The impact is confined to confidentiality; integrity and availability are not affected. However, the disclosed information can support downstream attacks such as privilege mapping or reconnaissance for follow-on exploitation.
The maintainer project has not yet responded to the GitHub issue #102 report, so no upstream patch is currently available.
Root Cause
The root cause is improper information handling within checkShellCommand in mercury-agent/src/capabilities/permissions.ts. The permission decision path exposes manifest data or command metadata to callers instead of returning only a boolean decision. This is a classic [CWE-200] information exposure pattern where security-relevant state crosses a trust boundary.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker submits shell commands or permission queries designed to trigger the leaky code path in the manifest checker. The response reveals information about protected commands, permissions, or configuration held by the agent. A public exploit has been made available, lowering the barrier to reproduction.
No verified proof-of-concept code is included here. Refer to the VulDB CVE-2026-90811 entry and the mercury-agent repository for technical references.
Detection Methods for CVE-2026-90811
Indicators of Compromise
- Repeated or unusual local invocations of mercury-agent shell command APIs from low-privileged accounts.
- Log entries showing enumeration-style queries against the Shell Permission Manifest.
- Presence of mercury-agent installations at or below version 1.2.0 on production systems.
Detection Strategies
- Instrument PermissionManager.checkShellCommand with verbose audit logging to capture caller identity, command string, and decision outcome.
- Baseline normal shell-command invocation patterns and alert on anomalous frequency or diversity of permission queries from a single local user.
- Review process telemetry for children of mercury-agent that correlate with permission-check bursts.
Monitoring Recommendations
- Forward mercury-agent application logs to a centralized log platform and retain them for correlation with host telemetry.
- Track version inventory of mercury-agent across hosts and flag any instance at 1.2.0 or earlier.
- Monitor the upstream GitHub repository and issue #102 for a maintainer response or patch release.
How to Mitigate CVE-2026-90811
Immediate Actions Required
- Inventory all systems running cosmicstack-labs mercury-agent and identify versions at or below 1.2.0.
- Restrict local access to hosts running mercury-agent to trusted, authenticated users only.
- Remove or disable mercury-agent on systems where its capabilities are not required.
- Subscribe to updates on GitHub issue #102 to track vendor remediation.
Patch Information
No official patch is available at the time of publication. The maintainers of cosmicstack-labs mercury-agent have not responded to the disclosure filed through the upstream issue tracker. Consult the VulDB vulnerability entry #403313 for updates as they become available.
Workarounds
- Apply strict host-level access controls to limit which local users can invoke mercury-agent shell command interfaces.
- Run mercury-agent under a dedicated, minimally privileged service account with restricted filesystem access.
- Where feasible, tighten the Shell Permission Manifest to remove commands that expose sensitive data or configuration.
- Consider isolating mercury-agent within a container or sandbox to constrain the blast radius of a successful information disclosure.
# Configuration example: restrict local access to the mercury-agent working directory
sudo chown -R mercury:mercury /opt/mercury-agent
sudo chmod 750 /opt/mercury-agent
sudo chmod 640 /opt/mercury-agent/src/capabilities/permissions.ts
# Limit shell access to the service account
sudo usermod -s /usr/sbin/nologin mercury
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
