CVE-2026-18998

MEDIUM 6.3

cosmicstack-labs mercury-agent delegate_task Tool sub-agent.ts SubAgent.run improper authorization

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

CWE	CWE-285 CWE-266
Vendor	cosmicstack-labs
Product	mercury-agent
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for cosmicstack-labs mercury-agent

Be the first to know when new medium vulnerabilities affecting cosmicstack-labs mercury-agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

cosmicstack-labs / mercury-agent

1.1.0 1.1.1 1.1.2 1.1.3 1.1.4 1.1.5 1.1.6 1.1.7 1.1.8 1.1.9 1.1.10 1.1.11 1.1.12

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386381 vuldb.com: https://vuldb.com/vuln/386381/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18998 vuldb.com: https://vuldb.com/submit/862628 vuldb.com: https://vuldb.com/submit/862629 github.com: https://github.com/cosmicstack-labs/mercury-agent/issues/74 github.com: https://github.com/cosmicstack-labs/mercury-agent/

Credits

🔍 ChenMarry (VulDB User) VulDB CNA Team