CVE-2026-18998 cosmicstack-labs CVE debrief

Who should care

Users of cosmicstack-labs mercury-agent up to version 1.1.12 should review and verify the vulnerability's impact on their systems. This includes reviewing the official CVE record and NVD details for further information and assessing potential exposure. Affected operators, platforms, vulnerability-management, and security teams should prioritize this vulnerability based on its potential impact and the current CVSS score of 2.1, which is considered low. However, given the public disclosure of the exploit, it is crucial to verify the existence of the vulnerability and its impact on the organization, check for vendor remediation or compensating controls, and monitor for potential exploitation attempts. Additionally, reviewing compensating controls for exposed systems while remediation is scheduled and verified is essential, along with tracking exceptions, retesting remediated assets, and closing the item only after evidence is documented. Lastly, confirming whether affected product deployments exist in managed environments and assigning an owner for follow-up is recommended. This review should be conducted with an emphasis on the specific context of the affected product and the operational impact of the vulnerability, taking into account the source-confidence limits and review context provided by the CVE record and NVD details. The goal is to ensure that all necessary steps are taken to mitigate the vulnerability and minimize potential damage, considering the low CVSS score but also the public disclosure of the exploit and the potential for remote attacks. Therefore, a thorough review of the vulnerability's impact and the implementation of appropriate defensive measures are crucial for affected users. The review process should be thorough and based on the information available from reliable sources such as the CVE record and NVD details, ensuring that all necessary precautions are taken to protect against potential exploitation. This involves not only technical teams but also management and security teams to ensure a comprehensive approach to mitigating the vulnerability. The information provided in the CVE record and NVD details should be used to prioritize and to

Technical summary

A vulnerability was determined in cosmicstack-labs mercury-agent up to 1.1.12, impacting the SubAgent.run function in src/core/sub-agent.ts, potentially leading to improper authorization. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet. The vulnerability has a low CVSS score of 2.1 and is considered a low-priority defensive review.

Defensive priority

Low-priority defensive review recommended due to limited details and low CVSS score.

Recommended defensive actions

• Verify the existence of the vulnerability and its impact on your organization
• Check for vendor remediation or compensating controls
• Monitor for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

Evidence is limited; verify vulnerability existence and impact through primary official records and vendor statements. The CVE record was published on 2026-08-06T06:16:32.790Z and has not been modified since then. Users should review the official CVE record and NVD details for further information.

Official resources