CVE-2026-18998 is an authorization vulnerability in cosmicstack-labs mercury-agent versions up to 1.1.12. It specifically impacts the SubAgent.run function within the src/core/sub-agent.ts file of the delegate_task Tool component. The flaw allows an attacker to perform unauthorized actions remotely by manipulating this function. The vulnerability was responsibly disclosed to the project, which has not yet issued a fix or response. The CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, reflecting network attack vector, low attack complexity, requiring low privileges, no user interaction, unchanged scope, and low impact on confidentiality, integrity, and availability.

The vulnerability permits improper authorization remotely, potentially allowing an attacker with low privileges to execute unauthorized actions affecting confidentiality, integrity, and availability to a low degree. While exploit code is publicly available, no active exploitation has been reported. The overall impact is assessed as low severity by the database.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the affected component and monitor for any suspicious activity related to the SubAgent.run function.