CVE-2026-18998

Name of the Vulnerable Software and Affected Versions cosmicstack-labs mercury-agent versions prior to 1.1.13

Description An issue exists in the delegate task Tool within the SubAgent.run() function located in the src/core/sub-agent.ts file. A remote attacker can perform a manipulation that leads to improper authorization, which occurs when a system fails to properly verify if a user has the necessary permissions to access a resource or perform an action.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the SubAgent.run() function to minimize the risk of exploitation.