Is there a public PoC exploit available for CVE-2026-18976?

Yes, a public proof-of-concept exploit is available for CVE-2026-18976. Prioritise patching immediately. EPSS: 0.2%.

Is there a patch available for CVE-2026-18976?

Yes, a patch is available for CVE-2026-18976. Update the affected software to the latest version immediately.

hermes-agent CVE-2026-18976

Q: What is the CVSS score of CVE-2026-18976?

CVE-2026-18976 has a CVSS 4.0 base score of 2.1 (Low). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-53698 LOW

Incorrect Privilege Assignment (CWE-266)

2026-08-06 VulDB

GHSA-6rr9-mpp7-j4mp

Information Disclosure Hermes Agent

2.1

CVSS 4.0 · Vendor: VulDB

Severity by source

Vendor (VulDB) PRIMARY

2.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.3 MEDIUM

Network-reachable but requires authenticated low-privilege access; scope unchanged; low C/I/A reflecting intra-application toolset bypass only.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (VulDB).

CVSS VectorVendor: VulDB

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Aug 06, 2026 - 02:29 vuln.today

Analysis Generated

Aug 06, 2026 - 02:29 vuln.today

Severity Changed

Aug 06, 2026 - 02:22 NVD

MEDIUM LOW

CVSS changed

Aug 06, 2026 - 02:22 NVD

5.3 (MEDIUM) 2.1 (LOW)

CVE Published

Aug 06, 2026 - 01:45 cve.org

LOW 2.1

DescriptionCVE.org

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

AnalysisAI

Incorrect privilege assignment in NousResearch hermes-agent through 0.16.0 allows authenticated remote users to invoke toolsets that administrators have explicitly disabled via the disabled_toolsets configuration. The flaw resides in get_tool_definitions within agent/agent_init.py, where the disabled_toolsets list was not checked before injecting tool definitions into an agent session, causing disabled tools (e.g., 'memory') to remain fully accessible. No active exploitation is confirmed (not in CISA KEV), but a public proof-of-concept exists via GitHub issue #46171 and an upstream fix is available in PR #46185.

Technical ContextAI

hermes-agent is a Python-based AI agent framework by NousResearch, requiring Python >=3.11,<3.14 and using pydantic-core with Rust-backed extensions. The vulnerable component is the disabled_toolsets Handler inside the init_agent function in agent/agent_init.py. The get_tool_definitions function builds the set of tools injected into an agent session; the intended design is that toolsets listed in disabled_toolsets (e.g., 'memory') are excluded from injection. CWE-266 (Incorrect Privilege Assignment) is the root cause: the conditional logic failed to evaluate whether a toolset appeared in agent.disabled_toolsets before injecting it, meaning the access restriction was silently bypassed. The fix in PR #46185 adds the guard: and not (agent.disabled_toolsets and 'memory' in agent.disabled_toolsets). The affected CPE is cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*.

RemediationAI

The upstream fix is available via GitHub PR #46185 (https://github.com/NousResearch/hermes-agent/pull/46185), which adds a guard to skip tool injection when the toolset is listed in disabled_toolsets. Users should update to a tagged release of hermes-agent that incorporates this PR once published; an exact patched release version is not yet independently confirmed from the available references. As a compensating control pending a formal release, operators can avoid using disabled_toolsets as a security boundary and instead enforce toolset restrictions at the agent session initialization layer or through external API access controls. Note that relying solely on the disabled_toolsets configuration for security enforcement on unpatched versions provides no effective restriction. The VulDB advisory is at https://vuldb.com/vuln/386264 and the originating issue report is at https://github.com/NousResearch/hermes-agent/issues/46171.