hermes-agent CVE-2026-14628

The Live Webhook Endpoint in hermes-agent must be network-accessible to the attacker. The CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N confirms no authentication, no special attack requirements, and no user interaction are needed - exploitation is possible against a default-configured, internet-exposed instance. Exploitation is limited by impact scope: only partial file read is achievable (VC:L), with no write or execution capability. Whether the Live Webhook Endpoint is enabled by default is unknown, as the vendor did not respond to disclosure and no official documentation was available in the provided intelligence; defenders should verify whether their deployments expose this endpoint before assessing actual risk. No specific non-default configuration, platform, or runtime condition has been identified as a prerequisite beyond the endpoint being reachable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms fully unauthenticated remote exploitation with no attack complexity or prerequisites, which is the highest-severity delivery posture. However, impact metrics are constrained: VC:L (low vulnerable-system confidentiality), with VI:N and VA:N - meaning this is a read-only partial disclosure vulnerability, not remote code execution or data destruction. The CVSS 4.0 base score of 5.5 reflects this impact ceiling. The E:P threat modifier confirms a proof-of-concept is publicly available on GitHub, elevating exploitation likelihood beyond a theoretical flaw. No EPSS data was provided; given the niche deployment footprint and low impact ceiling, real-world priority should be moderate for organizations running this software, but lower than the unauthenticated delivery vector alone might suggest. No CISA KEV listing means mass exploitation is not confirmed. The vendor's non-response to disclosure is a significant risk multiplier - no patch exists, and no official advisory clarifies default configurations or mitigations. CVSS score and network-accessible vector are confirmed; patch availability and active exploitation status are not confirmed.

An unauthenticated attacker sends a crafted HTTP request to the Live Webhook Endpoint with a manipulated media path parameter - for example, a value such as ../../etc/passwd or ../../app/config.env - targeting the extract_media function. The function processes the traversal sequence without sanitization and returns file contents from outside the intended directory, potentially disclosing credentials, environment variables, or internal configuration. A public proof-of-concept demonstrating this technique is available at https://gist.github.com/YLChen-007/8af7eff27b50bec24b2d0f76dd1c4383.