Mercury Agent Sub-agent Privilege Escalation via Incomplete Tool Filtering

Vulnerability Overview Title: [Security] Restricted Mercury sub-agents can enumerate and halt sibling agents despite allowedTools constraints #74 Description: A Mercury sub-agent explicitly restricted to still receives the full tool registry and can invoke and to enumerate and terminate sibling sub-agents. Any authenticated Web Dashboard user can send a chat prompt that causes Mercury to delegate work, thereby bypassing expected sub-agent control boundaries and interfering with parallel task execution. Details: The issue lies in a runtime policy binding vulnerability within the Mercury sub-agent execution path. The user-visible tool accepts an array of sub-agents and forwards them to , with the expectation that the runtime capabilities of the sub-agents will be narrowed accordingly. However, this expectation is not enforced. At runtime, always passes the full registry returned by to the AI SDK loop. The registry includes sub-agent orchestration tools as long as a supervisor exists: applies no descendant or ownership checks before terminating the requested target: Consequently, the restriction only persists in the prompt text, not in the actual tool surface exposed to the sub-model. In the validated exploit flow, a sub-agent limited to still receives and , using to identify sibling and then terminating it via . This issue is reachable via Mercury's normal authenticated web chat path: 1. POST accepts user-controlled chat content in . 2. The main agent processes the content and can invoke with attacker-influenced scheduling. 3. forwards the nominally restricted field to sub-agent creation. 4. ignores this restriction when constructing the executable tool map. 5. The sub-agent gains access to orchestration tools and can terminate sibling agents owned by the same workflow. Impact Scope Affected Product: - Ecosystem: npm - Package: @cosmicstack/mercury-agent - Affected Versions: <= 1.1.12 - Patch Version: None Severity: Medium Vector String: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H Weakness: CWE-285: Improper Authorization Remediation Patch Version: None POC Code Prerequisites Build Mercury Agent from the official upstream repository. A local environment capable of running the Web Dashboard on 127.0.0.1. Python 3 and Node.js installed. Ability to run the provided POC scripts locally. No source patching required. Reproduction Steps 1. Download the verification POC from . 2. Download the control POC from . 3. Download the shared harness from . 4. Build Mercury from the repository root: 5. Run the control case: 6. Confirm control output reports , sibling completes normally, and the restricted sub-agent only executes . 7. Run the exploit case: 8. Observe the exploit results: - Script reports - Victim sibling completes with status - Restricted sub-agent completes - Runtime evidence shows used and , despite being delegated with Evidence Logs Verified Runtime Logs Verification Mode: End-to-end Verification Mode: End-to-end From Exploit Run From Mercury Daemon Logs Impact This is an authorization and privilege scope bypass within Mercury's delegated sub-agent orchestration model. Low-privilege sub-agents can: Enumerate sibling sub-agents they should not have control over. Terminate ongoing sibling work. Disrupt the integrity and availability of parallel agent workflows. Invalidate the security assumption that meaningfully constrains delegated workers. In practice, any Mercury workflow relying on restricted sub-agents as a trust boundary can be subverted. The demonstrated impact today is cross-agent orchestration control; the same root cause implies that any high-impact tools in a shared registry may also be inadvertently exposed to restricted sub-agents in the future. Locations Permanent Links Summary The vulnerability allows restricted Mercury sub-agents to bypass constraints, enumerating and terminating sibling sub-agents, thereby impacting the integrity and availability of parallel task execution. The affected product version is <= 1.1.12, and there is currently no patch version available.

Goal Reached Thanks to every supporter — we hit 100%!

Mercury Agent Sub-agent Privilege Escalation via Incomplete Tool Filtering

More from this source