What is CVE-2026-18996?
A vulnerability in cosmicstack-labs mercury-agent up to version 1.1.12 involves incorrect privilege assignment in the 'PermissionManager.checkShellCommand' function of the 'run_command' handler. This allows execution of unauthorized high-privilege commands via manipulated input. Immediate update to the latest version is strongly recommended.
Azərbaycanca: cosmicstack-labs mercury-agent proqramının 1.1.12 versiyasına qədər olan versiyalarında 'run_command' handlerində aşkar edilmiş boşluq 'PermissionManager.checkShellCommand' funksiyasındakı səhv imtiyaz təyinatı ilə bağlıdır. Bu, uzaqdan istifadəçiyə sistemdə yüksək səviyyəli əmrlər icra etməyə imkan verir. Dərhal proqramı ən son versiyaya yeniləmək tövsiyə olunur.
Related CVEs
link basis: same weakness class CWE-732
FAQ2
In which component of mercury-agent was CVE-2026-18996 discovered?
The vulnerability was discovered in the 'run_command' handler, specifically involving incorrect privilege assignment in the 'PermissionManager.checkShellCommand' function.
What is the primary mitigation recommended for CVE-2026-18996?
Immediate update to the latest version is strongly recommended.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.