Skip to main content

Mercury Agent CVE-2026-90811

| EUVDEUVD-2026-77766 LOW
Information Exposure (CWE-200)
2026-09-14 VulDB GHSA-x845-4vjw-3f37
Information Disclosure Mercury Agent
1.9
CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY
1.9 MEDIUM
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (VulDB) · only source for this CVE.

CVSS VectorVendor: VulDB

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
X

Lifecycle Timeline

4
Analysis Generated
Sep 15, 2026 - 10:45 vuln.today
Severity Changed
Sep 14, 2026 - 19:22 NVD
MEDIUM LOW
CVSS changed
Sep 14, 2026 - 19:22 NVD
4.8 (MEDIUM) 1.9 (LOW)
CVE Published
Sep 14, 2026 - 18:45 cve.org
LOW 1.9

DescriptionCVE.org

A weakness has been identified in cosmicstack-labs mercury-agent up to 1.2.0. This affects the function PermissionManager.checkShellCommand of the file mercury-agent/src/capabilities/permissions.ts of the component Shell Permission Manifest. Executing a manipulation can lead to information disclosure. The attack is restricted to local execution. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.

AnalysisAI

A local information-disclosure weakness in cosmicstack-labs mercury-agent through version 1.2.0 lets a low-privileged local user manipulate the Shell Permission Manifest so that PermissionManager.checkShellCommand in mercury-agent/src/capabilities/permissions.ts mis-evaluates which shell commands are permitted. Successful abuse exposes sensitive data readable through the agent's shell capability, though integrity and availability are unaffected. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Mercury Agent

View all
CVE-2026-18996 LOW POC
2.1 Aug 06

Incorrect privilege assignment in cosmicstack-labs mercury-agent (all versions through 1.1.12) allows authenticated remo
CVE-2026-90810 LOW POC
2.1 Sep 14

Improper authorization in cosmicstack-labs mercury-agent's PermissionManager.checkShellCommand function (versions 1.1.0

CVE-2026-18998 LOW POC
2.1 Aug 06

Improper authorization in cosmicstack-labs mercury-agent's delegate_task tool allows a remotely authenticated low-privil
CVE-2026-18997 LOW POC
2.1 Aug 06

Incorrect authorization in cosmicstack-labs mercury-agent through version 1.1.12 allows remote authenticated attackers t
CVE-2026-90814 LOW POC
2.1 Sep 14

Server-side request forgery in cosmicstack-labs Mercury Agent (versions 1.1.0 through 1.1.13) lets an attacker who can i
CVE-2026-90813 LOW POC
2.1 Sep 14

Mercury Agent versions through 1.1.13 gate shell execution by validating commands before canonicalizing them, so a calle

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Share

CVE-2026-90811 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy