hermes-agent CVE-2026-18774

Exploitation requires a low-privileged authenticated session on the hermes-agent instance (PR:L in the CVSS 4.0 vector), ruling out fully unauthenticated remote exploitation. The vulnerable code path is specifically the xAI Image Generation Provider component; deployments that do not have this provider configured or enabled are not exposed to this attack surface. Exploitation is further constrained by whatever internal network resources the hermes-agent server process can reach - environments with strict egress filtering will experience reduced impact. No user interaction is required and complexity is low (AC:L, AT:N), meaning once prerequisites are met the attack is straightforward to execute.

The CVSS 4.0 score of 5.3 (Medium) reflects a genuine but constrained risk profile. The vector AV:N/AC:L/AT:N/PR:L/UI:N indicates network-reachable exploitation with low complexity requiring only low-privileged credentials - meaningfully limiting opportunistic mass exploitation but accessible to any authenticated user of the agent. Impact is rated partial across confidentiality, integrity, and availability (VC:L/VI:L/VA:L), consistent with SSRF capabilities: internal service probing, metadata exfiltration, and potential request forgery. The E:P modifier confirms a proof-of-concept exploit exists on GitHub (gist by YLChen-007), elevating near-term exploitation probability above baseline. No CISA KEV listing is present, so confirmed active exploitation in the wild is not established. The vendor did not respond to disclosure, meaning no official patch or advisory exists, leaving all deployed instances exposed indefinitely. For organizations running hermes-agent in environments with accessible internal services or cloud metadata endpoints, real-world risk substantially exceeds what the moderate CVSS score implies.

An attacker with a low-privileged account on a hermes-agent deployment submits a crafted image URL pointing to an internal cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/) to the xAI Image Generation Provider. The save_url_image function fetches the URL server-side and the response - containing IAM credential material - is returned or logged in a manner accessible to the attacker. A public proof-of-concept demonstrating this technique exists on GitHub.