Is there a public PoC exploit available for CVE-2026-18998?

Yes, a public proof-of-concept exploit is available for CVE-2026-18998. Prioritise patching immediately. EPSS: 0.2%.

mercury-agent CVE-2026-18998

Q: What is the CVSS score of CVE-2026-18998?

CVE-2026-18998 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53712 LOW

Improper Authorization (CWE-285)

2026-08-06 VulDB

GHSA-7hmv-r6w5-pr73

Authentication Bypass Mercury Agent Cosmicstack Labs

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

PR:L because low-privilege authentication is required; S:U and Low CIA because sub-agent scope is bounded with no evidence of scope change to other systems.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 06, 2026 - 06:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 06:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 06, 2026 - 05:51 vuln.today

CVE Published

Aug 06, 2026 - 04:45 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12. Impacted is the function SubAgent.run of the file src/core/sub-agent.ts of the component delegate_task Tool. Executing a manipulation can lead to improper authorization. It is possible to launch the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

Improper authorization in cosmicstack-labs mercury-agent's delegate_task tool allows a remotely authenticated low-privilege attacker to invoke SubAgent.run operations beyond their permitted scope in all versions through 1.1.12. No vendor patch has been released - the project was notified via issue report but has not responded. A public proof-of-concept exploit exists (GitHub issue #74), lowering the bar for exploitation in any exposed deployment.

Technical ContextAI

mercury-agent is an AI agent orchestration framework by cosmicstack-labs (CPE: cpe:2.3:a:cosmicstack-labs:mercury-agent:*:*:*:*:*:*:*:*). The vulnerability resides in the SubAgent.run function within src/core/sub-agent.ts, specifically in the delegate_task tool - the mechanism by which one agent delegates work to a sub-agent. CWE-285 (Improper Authorization) indicates the system does not correctly verify whether the requesting principal is authorized to perform the requested sub-agent operation before executing it. This is distinct from an authentication failure: the caller is recognized by the system (PR:L confirms credentials are required), but the authorization gate that should restrict which sub-agent tasks a given caller can issue is insufficiently enforced. In multi-agent architectures, delegate_task authorization is critical because sub-agents may carry elevated access to downstream resources.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor had not responded to responsible disclosure as of the report date, so no fixed version exists to upgrade to. As the most direct compensating control, disable or gate the delegate_task tool at the application or configuration layer if multi-agent delegation is not required in your deployment; this eliminates the vulnerable code path at the cost of sub-agent orchestration functionality. If delegate_task is required, enforce a strict allowlist of permitted sub-agent operations at the API gateway or middleware layer, rejecting requests that do not match explicitly authorized task types for the authenticated principal. Restrict network exposure of the mercury-agent API to the minimum necessary set of trusted clients, reducing the pool of accounts that can attempt exploitation. Monitor the upstream repository (https://github.com/cosmicstack-labs/mercury-agent/) and issue #74 (https://github.com/cosmicstack-labs/mercury-agent/issues/74) for patch availability and apply promptly once released.