EUVD-2026-41654
GHSA-pxqg-8rwp-q2x2
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network vector with authenticated low-privilege access and high complexity required; impact is confidentiality-only at low severity with no scope change.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."
AnalysisAI
Case-sensitivity bypass in NousResearch hermes-agent through version 2026.4.30 allows authenticated remote attackers to leak limited reasoning content that should have been scrubbed by the Streaming Reasoning Tag Filter. The vulnerability resides in GatewayStreamConsumer._filter_and_accumulate within gateway/stream_consumer.py, where tag matching fails to account for case variations, permitting reasoning tokens to escape filtration. A public proof-of-concept exploit has been disclosed; however, the vendor has formally declined to issue a patch, classifying the maintenance cost as disproportionate to the assessed risk.
Technical ContextAI
CWE-178 (Improper Handling of Case Sensitivity) describes root causes where security-relevant string comparisons operate case-sensitively when they should be case-insensitive or normalized. In hermes-agent, an AI agent gateway product by NousResearch, streaming LLM responses contain reasoning tags that the _filter_and_accumulate method is expected to detect and strip before returning output to the caller. Because the filter performs case-sensitive tag matching, an adversary can introduce case-variant tag markers (e.g., uppercase, mixed-case) that the filter fails to recognize, causing protected reasoning content to pass through. The CVSS 4.0 vector AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N confirms only low confidentiality impact with no integrity or availability consequence, consistent with an information-disclosure-only flaw in a stream scrubbing layer.
RemediationAI
No vendor-released patch is planned. The vendor explicitly acknowledged the validity of the reported issue and a proposed fix but declined to implement it, stating: 'the analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path' (see GitHub PR https://github.com/NousResearch/hermes-agent/pull/28631#issuecomment-4622188016). Specific compensating controls for operators who require strict reasoning content confidentiality include: (1) applying the community-proposed fix from the referenced PR as a local patch - the trade-off is maintaining a fork diverging from upstream; (2) restricting hermes-agent access to only fully trusted, authenticated principals to eliminate the PR:L exploitation pathway; or (3) deploying an upstream reverse proxy that normalizes all tag markers to a canonical case before content reaches the filter, at the cost of additional infrastructure complexity. No advisory URL with a patched release version exists at time of analysis.
Same weakness CWE-178 – Improper Handling of Case Sensitivity
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today