Is there a public PoC exploit available for CVE-2026-18775?

Yes, a public proof-of-concept exploit is available for CVE-2026-18775. Prioritise patching immediately. EPSS: 0.3%.

hermes-agent CVE-2026-18775

Q: What is the CVSS score of CVE-2026-18775?

CVE-2026-18775 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-52766 LOW

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 VulDB

GHSA-4294-5q8h-pq8p

SSRF Hermes Agent Nousresearch

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.4 MEDIUM

Network-reachable SSRF requiring low-privileged authentication (PR:L); no scope change; availability impact omitted as SSRF does not directly degrade service.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Aug 04, 2026 - 17:23 NVD

MEDIUM LOW

CVSS changed

Aug 04, 2026 - 17:23 NVD

5.3 (MEDIUM) 2.1 (LOW)

Analysis Generated

Aug 04, 2026 - 17:11 vuln.today

CVE Published

Aug 04, 2026 - 16:15 cve.org

MEDIUM 5.3

DescriptionCVE.org

A vulnerability has been found in NousResearch hermes-agent up to 0.16.0. This vulnerability affects the function browser_snapshot of the file tools/browser_tool.py of the component Browser Tooling. Such manipulation leads to server-side request forgery. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Server-side request forgery in NousResearch hermes-agent up to version 0.16.0 allows low-privileged remote attackers to manipulate the server into issuing arbitrary HTTP requests via the browser_snapshot function in tools/browser_tool.py. Exploitation can expose internal network services, cloud provider metadata endpoints, and other non-public resources reachable from the server. A public proof-of-concept exploit has been disclosed; the vendor did not respond to coordinated disclosure.

Technical ContextAI

hermes-agent is an AI agent framework developed by NousResearch, providing browser automation tooling via tools/browser_tool.py. The browser_snapshot function accepts user-controlled input specifying a target URL or resource to capture, which is then fetched by the server without adequate validation or allowlisting. CWE-918 (Server-Side Request Forgery) describes flaws where an application makes outbound HTTP requests based on attacker-supplied data, enabling access to internal infrastructure the attacker cannot reach directly. In AI agent deployments, this class of vulnerability is particularly impactful because agents frequently run with broad network access to support tool use. The affected CPE is cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*, covering all versions through 0.16.0.

RemediationAI

No vendor-released patch has been identified at time of analysis - the vendor did not respond to disclosure. Until a fix is released, defenders should apply the following specific compensating controls: restrict outbound network egress from the hermes-agent process using host-based firewall rules or container network policies, explicitly blocking access to RFC-1918 address ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254, fd00:ec2::254); disable or remove the browser_tool.py component entirely if browser snapshot functionality is non-essential; require strong authentication and minimize the number of users granted low-privileged access to the agent. If running in AWS, enable IMDSv2 enforcement (hop limit=1) to prevent metadata theft via SSRF even if egress is not fully blocked. Monitor for disclosure of a patched version via the VulDB entry at https://vuldb.com/vuln/385785.