Is there a public PoC exploit available for CVE-2026-14627?

Yes, a public proof-of-concept exploit is available for CVE-2026-14627. Prioritise patching immediately. EPSS: 0.4%.

hermes-agent CVE-2026-14627

Q: What is the CVSS score of CVE-2026-14627?

CVE-2026-14627 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-41672 LOW

Improper Authentication (CWE-287)

2026-07-04 VulDB

GHSA-v8jw-9wv4-wxg3

Authentication Bypass Hermes Agent Nousresearch

2.9

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.6 MEDIUM

Network vector via Discord (AV:N), AC:H reflects complex exploit conditions per description; PR:N because no hermes-agent credentials are required, only Discord server membership.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 04, 2026 - 13:31 vuln.today

Severity Changed

Jul 04, 2026 - 13:22 NVD

MEDIUM LOW

CVSS changed

Jul 04, 2026 - 13:22 NVD

6.3 (MEDIUM) 2.9 (LOW)

DescriptionCVE.org

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Improper authentication in NousResearch hermes-agent through version 0.15.2 allows remote attackers to bypass the Discord user allowlist by exploiting a logic flaw in the DiscordAdapter._is_allowed_user function within gateway/platforms/discord.py. Exploitation is rated high complexity (CVSS 4.0 AC:H), resulting in limited but confirmed confidentiality, integrity, and availability impact against the vulnerable system. A public proof-of-concept exploit has been disclosed via GitHub Gist; no vendor patch exists as the vendor did not respond to responsible disclosure.

Technical ContextAI

hermes-agent is an AI agent orchestration framework by NousResearch that supports multiple platform integrations, including Discord via a gateway adapter. The vulnerable component is the DiscordAdapter class in gateway/platforms/discord.py, specifically its _is_allowed_user method, which is responsible for enforcing an allowlist of permitted Discord users before processing agent commands. CWE-287 (Improper Authentication) indicates that the function's logic fails to correctly verify the identity or membership of the requesting Discord user, allowing the check to be bypassed. The CPE cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:* covers all versions through 0.15.2 as affected. No subsequent-system scope change is indicated (SC:N/SI:N/SA:N), confining impact to the agent process itself.

RemediationAI

No vendor-released patch has been identified at time of analysis; the vendor did not respond to responsible disclosure, and no fix version is confirmed. The most effective compensating control is to disable or remove the Discord platform integration entirely - specifically by not configuring or instantiating DiscordAdapter - which eliminates the attack surface without affecting other agent functionality. If Discord integration is operationally required, restrict the bot to private Discord servers with tightly controlled membership and audit all bot interaction logs for anomalous or unauthorized command activity. Operators should monitor the NousResearch hermes-agent repository and VulDB entry https://vuldb.com/vuln/376143 for any upstream fix. Note that disabling Discord integration may impact legitimate workflows relying on bot commands.