CVE-2026-18996 cosmicstack-labs CVE debrief

Who should care

Users of cosmicstack-labs mercury-agent up to version 1.1.12 should review and potentially update their installations. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.

Technical summary

A vulnerability in cosmicstack-labs mercury-agent up to 1.1.12 allows incorrect privilege assignment via the PermissionManager.checkShellCommand function. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.

Defensive priority

Low-priority defensive review recommended due to limited details and low CVSS score.

Recommended defensive actions

• Review the CVE record and NVD entry for accuracy
• Verify affected versions and inventory for cosmicstack-labs mercury-agent
• Monitor for potential exploit attempts
• Consider compensating controls until vendor remediation is available
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

Evidence is limited; verify vulnerability existence and impact through primary official records and vendor statements. The CVE record was published on 2026-08-06T05:16:42.087Z and has not been modified since then. Users should review the NVD entry and CVE record for accuracy and verify affected versions and inventory for cosmicstack-labs mercury-agent. Consider compensating controls until vendor remediation is available.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.