hermes-agent CVE-2026-18976

Exploitation requires a valid authenticated session with hermes-agent (PR:L per CVSS 4.0). The vulnerability is only triggerable when the disabled_toolsets configuration is actively used to restrict tool access for a given agent - deployments that do not rely on disabled_toolsets for access control are not affected by this specific flaw. The attack is initiated remotely over the network (AV:N). Limiting factors include: mandatory prior authentication, dependency on the disabled_toolsets feature being in use as a security control, and impact confined to accessing tool categories within the hermes-agent application rather than broader system access. No special platform, operating system, or non-default installation is otherwise required.

The CVSS 4.0 base score of 2.1 (Very Low) correctly reflects the constrained blast radius: PR:L confirms exploitation requires an authenticated session, and VC:L/VI:L/VA:L indicate only low-level impacts across confidentiality, integrity, and availability with no subsequent-system impact (SC:N/SI:N/SA:N). The E:P modifier confirms a publicly available exploit (GitHub issue #46171). The vulnerability is not listed in CISA KEV, and no EPSS data was provided in the input - exploitation probability cannot be independently quantified. Real-world risk is moderate-to-low: this is an intra-application privilege boundary violation rather than a system-level compromise; an attacker must already hold authenticated access and the impact is limited to bypassing toolset restrictions. The public disclosure via a GitHub issue means the attack surface is well-understood, but the requirement for prior authentication substantially limits opportunistic exploitation. This is a genuine fix-when-patching priority rather than an emergency response item.

An authenticated user of hermes-agent who is subject to an administrator-enforced disabled_toolsets restriction (e.g., the 'memory' toolset is disabled for their agent) initiates a session and calls tools from the supposedly disabled toolset. Because get_tool_definitions does not check disabled_toolsets before injection, the full tool set is available despite the policy. A public GitHub issue (#46171) demonstrates this behavior, making reproduction straightforward for any authenticated user.