hermes-agent CVE-2026-18775

Exploitation requires a valid low-privileged authenticated session on the hermes-agent instance - unauthenticated access is not sufficient per the CVSS 4.0 PR:L metric. The attacker must have the ability to invoke the browser_snapshot function in tools/browser_tool.py with attacker-controlled URL input; this is the specific attack surface. No additional special configuration is required beyond having access to the Browser Tooling component, which appears to be part of the default agent capability set. Limiting factors include: the requirement for at least low-privileged authentication, and the degree of impact being constrained to resources the server can reach (internal network scope). Environments that already enforce strict outbound egress filtering will significantly reduce the blast radius even if exploitation occurs.

The CVSS 4.0 base score of 5.3 (Medium) reflects the realistic, bounded impact: AV:N confirms network exploitability, AC:L indicates no special conditions, and PR:L means a low-privileged authenticated session is required - reducing opportunistic mass exploitation. VC:L/VI:L/VA:L indicate limited but real impact across all three dimensions. No CISA KEV listing is present, so active widespread exploitation is not confirmed. However, E:P in the CVSS 4.0 environmental supplemental metric flags a publicly available exploit (confirmed via GitHub gist by YLChen-007), meaningfully elevating practical risk above a theoretical finding. SSRF in AI agent frameworks warrants elevated concern because agents often run adjacent to cloud metadata services (e.g., AWS IMDSv1 at 169.254.169.254), internal APIs, and orchestration services - all reachable from the server side. The vendor did not respond to disclosure, leaving no official mitigation. The limited privilege requirement (PR:L) means any authenticated user of the agent can trigger this, not just administrators.

An attacker with a low-privileged account on a hermes-agent deployment sends a crafted browser_snapshot request specifying an internal URL such as http://169.254.169.254/latest/meta-data/ or an internal microservice endpoint. The agent server fetches the target URL and returns its contents, exposing cloud credentials, internal service responses, or topology data. A public proof-of-concept is available at https://gist.github.com/YLChen-007/2e5bf7fa58113967807425032234cc89, reducing the skill threshold for exploitation.