CVE-2026-18996

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS v3 6.3 MEDIUM
CVSS v2.0 6.5 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

6.5^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability : 8.0 / Impact : 6.4

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://github.com/cosmicstack-labs/mercury-agent/
https://github.com/cosmicstack-labs/mercury-agent/issues/72
https://vuldb.com/cve/CVE-2026-18996
https://vuldb.com/submit/862625
https://vuldb.com/submit/862630
https://vuldb.com/submit/862636
https://vuldb.com/submit/862637
https://vuldb.com/vuln/386379
https://vuldb.com/vuln/386379/cti

Configurations

No configuration.

History

23 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad ha sido encontrada en cosmicstack-labs mercury-agent hasta la versión 1.1.12. Esta vulnerabilidad afecta a la función PermissionManager.checkShellCommand del archivo src/capabilities/permissions.ts del componente run_command Gestor. Dicha manipulación conduce a una asignación de privilegios incorrecta. El ataque puede ser realizado desde remoto. El exploit ha sido divulgado al público y puede ser utilizado. El proyecto fue informado del problema tempranamente a través de un informe de incidencias pero aún no ha respondido.

Information

Published : 2026-08-06 05:16

Updated : 2026-10-23 21:10

NVD link : CVE-2026-18996

Mitre link : CVE-2026-18996

CVE.ORG link : CVE-2026-18996

JSON object : View

Products Affected

No product.

CWE

CWE-266

Incorrect Privilege Assignment

{"id": "CVE-2026-18996", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-18996", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-06T12:12:48.835183Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 6.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P", "authentication": "SINGLE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 3.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "PROOF_OF_CONCEPT", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*"], "vendor": "cosmicstack-labs", "modules": ["run_command Handler"], "product": "mercury-agent", "versions": [{"status": "affected", "version": "1.1.0"}, {"status": "affected", "version": "1.1.1"}, {"status": "affected", "version": "1.1.2"}, {"status": "affected", "version": "1.1.3"}, {"status": "affected", "version": "1.1.4"}, {"status": "affected", "version": "1.1.5"}, {"status": "affected", "version": "1.1.6"}, {"status": "affected", "version": "1.1.7"}, {"status": "affected", "version": "1.1.8"}, {"status": "affected", "version": "1.1.9"}, {"status": "affected", "version": "1.1.10"}, {"status": "affected", "version": "1.1.11"}, {"status": "affected", "version": "1.1.12"}]}]}], "published": "2026-08-06T05:16:42.087", "references": [{"url": "https://github.com/cosmicstack-labs/mercury-agent/", "source": "cna@vuldb.com"}, {"url": "https://github.com/cosmicstack-labs/mercury-agent/issues/72", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-18996", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862625", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862630", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862636", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/862637", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/386379", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/386379/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-266"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en cosmicstack-labs mercury-agent hasta la versi\u00f3n 1.1.12. Esta vulnerabilidad afecta a la funci\u00f3n PermissionManager.checkShellCommand del archivo src/capabilities/permissions.ts del componente run_command Gestor. Dicha manipulaci\u00f3n conduce a una asignaci\u00f3n de privilegios incorrecta. El ataque puede ser realizado desde remoto. El exploit ha sido divulgado al p\u00fablico y puede ser utilizado. El proyecto fue informado del problema tempranamente a trav\u00e9s de un informe de incidencias pero a\u00fan no ha respondido."}], "lastModified": "2026-10-23T21:10:00.157", "sourceIdentifier": "cna@vuldb.com"}