Is there a public PoC exploit available for CVE-2026-18996?

Yes, a public proof-of-concept exploit is available for CVE-2026-18996. Prioritise patching immediately. EPSS: 0.2%.

mercury-agent CVE-2026-18996

Q: What is the CVSS score of CVE-2026-18996?

CVE-2026-18996 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53709 LOW

Incorrect Privilege Assignment (CWE-266)

2026-08-06 VulDB

GHSA-ccg4-hv3q-9622

Information Disclosure Mercury Agent Cosmicstack Labs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable with low-privilege authentication required (PR:L); limited C/I/A impact consistent with partial privilege bypass, no scope change.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 05:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 05:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 06, 2026 - 04:49 vuln.today

CVE Published

Aug 06, 2026 - 04:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in cosmicstack-labs mercury-agent up to 1.1.12. This vulnerability affects the function PermissionManager.checkShellCommand of the file src/capabilities/permissions.ts of the component run_command Handler. Such manipulation leads to incorrect privilege assignment. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Incorrect privilege assignment in cosmicstack-labs mercury-agent (all versions through 1.1.12) allows authenticated remote attackers to bypass shell command permission checks via the run_command Handler. The flaw resides in the PermissionManager.checkShellCommand function within src/capabilities/permissions.ts, where privilege levels are not correctly validated, potentially enabling a low-privileged user to execute shell commands exceeding their authorized scope. A public proof-of-concept exploit exists via GitHub issue #72, and the project maintainer has not responded to responsible disclosure, leaving no vendor-released patch available at time of analysis.

Technical ContextAI

mercury-agent is a TypeScript-based agent framework developed by cosmicstack-labs, designed to handle capability-based command execution. The vulnerable component is the PermissionManager class in src/capabilities/permissions.ts, specifically the checkShellCommand method invoked by the run_command Handler. CWE-266 (Incorrect Privilege Assignment) identifies the root cause: the permission-checking logic fails to properly assign or enforce privilege tiers when evaluating shell command requests, meaning a caller with low-level credentials can trigger command execution paths intended only for higher-privilege roles. The CPE cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:* covers all releases up to and including 1.1.12 as the affected scope.

RemediationAI

No vendor-released patch is available at time of analysis - the project maintainer was notified via a responsible disclosure issue report but has not responded. Operators running mercury-agent versions up to 1.1.12 should consider the following compensating controls: restrict access to the run_command Handler endpoint at the network or API-gateway level so that only explicitly trusted, audited principals can invoke it, reducing the attack surface even if the privilege check itself is flawed; enforce strict network segmentation so the agent is not reachable from untrusted network segments; and monitor shell command execution logs for privilege anomalies or unexpected command patterns. Note that restricting the run_command Handler may degrade intended agent functionality. Organizations should track the upstream repository (https://github.com/cosmicstack-labs/mercury-agent/) and the VulDB entry (https://vuldb.com/vuln/386379) for patch availability and respond immediately by upgrading once a fixed release is published.