hermes-agent CVE-2026-84289

Exploitation requires a low-privilege authenticated account with access to the hermes-agent MCP tool interface - specifically the list_tools function in tools/mcp_tool.py. The CVSS 4.0 vector confirms PR:L (low privilege required) and AV:N (network-accessible), so the attacker must be authenticated but does not need administrative rights. No special non-default configuration is documented as required. Exploitation is limited to availability impact only (VA:L); there is no path to confidentiality or integrity compromise. Single-user or locally-deployed instances with no external user access are not realistically at risk.

Real-world risk is low-to-moderate for deployments that expose hermes-agent to untrusted or multi-tenant users. CVSS 4.0 scores this at 2.1, reflecting the low availability impact (VA:L) and the PR:L requirement - an authenticated low-privilege user is needed, which materially reduces the threat surface compared to unauthenticated vectors. There is no confidentiality or integrity impact (VC:N/VI:N), so this is strictly a denial-of-service issue, contradicting the 'Information Disclosure' tag applied in the input metadata. The CVSS E:P modifier confirms the public exploit is real. EPSS data is not provided, and the CVE is not listed in CISA KEV. Practically, this vulnerability is relevant primarily in multi-user or SaaS deployments of hermes-agent where untrusted low-privilege users can invoke the MCP tool interface; single-user or locally-deployed instances face minimal risk. The vendor's non-response to disclosure is a negative signal for patch availability.

An authenticated low-privilege user with access to a multi-user hermes-agent deployment sends crafted input to the list_tools MCP endpoint, causing the agent process to allocate memory without bound proportional to the attacker-controlled payload. Repeated or sustained requests exhaust available memory, degrading or crashing the agent service for all users. A public proof-of-concept report documenting the resource amplification technique is available on GitHub, lowering the bar for exploitation.