Is there a public PoC exploit available for CVE-2026-18774?

Yes, a public proof-of-concept exploit is available for CVE-2026-18774. Prioritise patching immediately. EPSS: 0.2%.

hermes-agent CVE-2026-18774

Q: What is the CVSS score of CVE-2026-18774?

CVE-2026-18774 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-52764 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 VulDB

GHSA-pgm4-hcxr-45qw

SSRF Hermes Agent Nousresearch

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network SSRF requiring low-privilege auth; partial confidentiality and integrity impact from server-side request forgery; no direct availability impact on the vulnerable system.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 04, 2026 - 17:23 NVD

MEDIUM LOW

CVSS changed

Aug 04, 2026 - 17:23 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 04, 2026 - 17:11 vuln.today

CVE Published

Aug 04, 2026 - 16:00 cve.org

MEDIUM 5.3

DescriptionCVE.org

A flaw has been found in NousResearch hermes-agent up to 0.16.0. This affects the function save_url_image of the file agent/image_gen_provider.py of the component xAI Image Generation Provider. This manipulation causes server-side request forgery. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in NousResearch hermes-agent through version 0.16.0 allows authenticated remote attackers to coerce the server into making arbitrary outbound HTTP requests by supplying a crafted URL to the xAI Image Generation Provider component. The vulnerability resides in the save_url_image function within agent/image_gen_provider.py, which fails to validate or restrict URLs before fetching them server-side. A proof-of-concept exploit has been publicly disclosed on GitHub; no vendor patch exists as the vendor did not respond to disclosure outreach.

Technical ContextAI

The affected component is the xAI Image Generation Provider within NousResearch hermes-agent (CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*), an AI agent framework. The root cause is CWE-918 (Server-Side Request Forgery): the save_url_image function in agent/image_gen_provider.py accepts a user-supplied URL and passes it to a server-side HTTP fetching routine without adequate validation of scheme, destination host, or port. This allows the server to be directed to contact arbitrary endpoints including internal network services (e.g., cloud metadata endpoints, internal APIs, private subnets) that the attacker cannot reach directly.

RemediationAI

No vendor-released patch has been identified at time of analysis, as the vendor did not respond to disclosure. The most effective compensating control is to disable or remove the xAI Image Generation Provider component entirely if it is not required - this eliminates the vulnerable code path. If the provider must remain active, implement strict egress firewall rules to block the hermes-agent server from reaching RFC 1918 private address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local ranges (169.254.0.0/16, including AWS/GCP/Azure metadata endpoints at 169.254.169.254), and loopback (127.0.0.0/8). Deploying an application-level URL allowlist that restricts the save_url_image function to approved external image hosting domains is the most targeted mitigation, though it requires code modification. Monitoring outbound HTTP logs from the server process for anomalous internal destinations can serve as a detection control. Exploit code is publicly available at https://gist.github.com/YLChen-007/7c71603a25d84f372f2275dd570e99d4 - defenders should review it to understand the exact request structure for detection rule development.