CVE-2026-90812: Mercury-Agent Privilege Escalation Flaw

CVE-2026-90812 Overview

CVE-2026-90812 is an incorrect privilege assignment vulnerability [CWE-266] affecting cosmicstack-labs mercury-agent up to version 1.2.0. The flaw resides in the checkShellCommand function within src/capabilities/permissions.ts, which implements the Shell Command Permission component. An attacker with low privileges can manipulate the permission check remotely, bypassing intended restrictions on shell command execution. The exploit details have been disclosed publicly, though no active exploitation has been reported. The maintainers were notified through a public issue report but had not responded at the time of disclosure.

Critical Impact
Remote attackers with low privileges can bypass shell command permission controls in mercury-agent, potentially executing commands that should be restricted by policy.

Affected Products

cosmicstack-labs mercury-agent versions up to and including 1.2.0
Component: Shell Command Permission (src/capabilities/permissions.ts)
Function: checkShellCommand

Discovery Timeline

2026-09-14 - CVE-2026-90812 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90812

Vulnerability Analysis

The vulnerability lies in how mercury-agent evaluates shell command permissions. The checkShellCommand function in src/capabilities/permissions.ts performs authorization checks that fail to correctly assign or enforce privilege boundaries. As a result, callers can pass input that satisfies the check while executing shell operations that policy should deny.

Because the flaw sits in the permission-checking layer, it undermines an integrity boundary the project treats as trusted. The attack requires only low-level privileges on the agent and can be triggered over the network, making it accessible to any authenticated user with minimal access. According to the published advisory, confidentiality impact is limited and there is no direct integrity or availability impact recorded, keeping the overall risk profile modest.

Root Cause

The root cause is incorrect privilege assignment [CWE-266] within the shell command permission logic. The checkShellCommand function does not correctly map the caller's privilege context to the set of permitted commands, allowing operations that fall outside the intended permission grant to succeed.

Attack Vector

Exploitation occurs over the network against an instance of mercury-agent where the attacker holds low-privilege credentials. The attacker crafts a request that traverses the flawed checkShellCommand path, causing the agent to treat a restricted shell command as authorized. No user interaction is required. Public disclosure of the exploit details in the VulDB CVE-2026-90812 entry and GitHub Issue #80 for Mercury Agent lowers the barrier to reproduction.

No verified code examples are available. See the GitHub Mercury Agent Repository for the affected source file and the linked issue for technical context.

Detection Methods for CVE-2026-90812

Indicators of Compromise

Unexpected shell commands issued through mercury-agent by accounts holding only low-privilege roles.
Log entries from checkShellCommand showing permission grants that do not align with the caller's assigned role.
Process execution telemetry on hosts running mercury-agent that spawns shells or system binaries outside expected automation patterns.

Detection Strategies

Enable verbose logging of the Shell Command Permission component and alert on any command executed by a non-administrative principal.
Correlate mercury-agent command execution events with the invoking identity to surface privilege mismatches.
Baseline the set of commands each role is expected to run and flag deviations for review.

Monitoring Recommendations

Monitor child processes of the mercury-agent process for unexpected shells, interpreters, or system utilities.
Forward mercury-agent audit logs to a central SIEM and retain them for post-incident review.
Track outbound network activity from hosts running mercury-agent for signs of follow-on command-and-control behavior.

How to Mitigate CVE-2026-90812

Immediate Actions Required

Inventory all deployments of cosmicstack-labs mercury-agent and identify instances running version 1.2.0 or earlier.
Restrict network exposure of mercury-agent endpoints to trusted management networks only.
Reduce the number of accounts with any privilege on mercury-agent and rotate credentials for existing low-privilege users.
Review recent shell command execution logs for signs of permission bypass consistent with CVE-2026-90812.

Patch Information

At the time of publication, the project maintainers had not responded to the disclosed issue, and no official patch has been referenced in the advisory. Monitor the GitHub Mercury Agent Repository and GitHub Issue #80 for Mercury Agent for a fix. Additional tracking is available through VulDB Vulnerability #403314.

Workarounds

Place mercury-agent behind a network policy that limits access to administrative operators only.
Disable or remove the Shell Command Permission capability where it is not required for operations.
Wrap mercury-agent invocations with an external policy layer, such as an allowlist proxy, that independently validates commands before they reach the agent.
Run mercury-agent under a dedicated low-privilege operating system account to contain the blast radius if the permission check is bypassed.

bash

# Configuration example: restrict network access to mercury-agent
# Example iptables rule allowing only the management subnet to reach the agent port
iptables -A INPUT -p tcp --dport <mercury-agent-port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <mercury-agent-port> -j DROP