EUVD-2026-53706
GHSA-4992-66px-gwh3
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege credentials
-
DeliverySend agent session request over network
-
Exploittrigger init_agent() without disabled_toolsets guard
-
ExecutionMemory Toolset injected despite operator restriction
-
ImpactInvoke restricted memory read/write operations
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Access control enforcement
MITRE ATT&CK
1 technique across 1 tactic: Defense Evasion The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires low-privilege authenticated access to a hermes-agent instance - unauthenticated access is not sufficient per the CVSS 4.0 PR:L metric. The vulnerability is only meaningful in deployments where an operator has explicitly added 'memory' to the agent's |
| Impact | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N with VC:L/VI:L/VA:L and E:P) characterizes this as a medium-severity, network-exploitable access control bypass requiring low privilege with a public exploit. Real-world risk is bounded by the PR:L requirement - only authenticated users can exploit this - and by the low-level impacts across confidentiality, integrity, and availability. The vulnerability is not listed in CISA KEV, indicating no confirmed widespread active exploitation. However, the public exploit (E:P) lowers the bar for abuse in environments where memory isolation is a deliberate security boundary. The risk is most significant for multi-tenant or shared hermes-agent deployments where operators explicitly disable the Memory Toolset to limit user access. Single-user or fully-trusted deployments face negligible incremental risk. No conflicting signals are present; CVSS and description are consistent. |
| Exploit ScenarioDerived | A low-privilege authenticated user with network access to a hermes-agent deployment sends a request to create or interact with an agent session on an instance where the operator has configured |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 06, 2026
Improper access control in NousResearch hermes-agent up to 0.16.0 allows low-privileged authenticated users to invoke the Memory Toolset even when it has been explicitly disabled by an operator via the disabled_toolsets configuration. The root cause is a missing guard in init_agent() within agent/agent_init.py, which unconditionally injected the Memory Toolset regardless of operator-level restrictions. A public proof-of-concept exploit exists (GitHub issue #48181), and a vendor patch is available via pull request #46185.
RemediationAI
The upstream fix is available in GitHub Pull Request #46185 (https://github.com/NousResearch/hermes-agent/pull/46185), which patches agent/agent_init.py to skip Memory Toolset injection when 'memory' appears in agent.disabled_toolsets. A specific tagged patched release version has not been confirmed from available data - only the upstream PR exists. Operators should pull the latest commit from the main branch or apply the patch from PR #46185 directly. As a compensating control prior to patching, operators can restrict network access to the hermes-agent API to only fully trusted, low-risk authenticated users, reducing the pool of principals capable of exploiting the bypass. Restricting which users can create agent sessions is a secondary mitigation with no functional side effects for legitimate workflows.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
hermes-agent is an AI agent orchestration framework by NousResearch (CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*). The vulnerable component is the Memory Toolset, implemented in hermes-agent/model_tools.py and injected during agent initialization in agent/agent_init.py. The root cause class is CWE-284 (Improper Access Control): the init_agent() function failed to check whether disabled_toolsets contained the string 'memory' before injecting the Memory Toolset into the agent session. The patch (PR #46185) adds the guard and not (agent.disabled_toolsets and 'memory' in agent.disabled_toolsets) to enforce operator-level toolset suppression. This type of flaw is characteristic of authorization logic that enforces restrictions at configuration time but fails to propagate those restrictions into initialization pathways.
Know when Hermes Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Network-exploitable with no special conditions, but PR:L required per CVSS 4.0 signal; low impacts across all dimensions with no scope change beyond the vulnerable system.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was detected in NousResearch hermes-agent up to 0.16.0. Affected by this issue is some unknown functionality of the file hermes-agent/model_tools.py of the component Memory Toolset. The manipulation results in improper access controls. The attack can be executed remotely. The exploit is now public and may be used.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Hermes Agent
View allRemote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the
Path traversal in NousResearch hermes-agent through version 2026.4.16 allows remote unauthenticated attackers to bypass
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipula
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attacker
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _comp
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate t
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbi
Improper output escaping in NousResearch Hermes Agent versions up to 2026.4.16 allows remote unauthenticated attackers t
Remote injection vulnerability in NousResearch hermes-agent versions up to 2026.4.23 enables unauthenticated attackers t
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenti
Exploit-DB