hermes-agent CVE-2026-85106

Exploitation requires an authenticated session (CVSS PR:L) - the attacker must hold a valid low-privilege user account in hermes-agent. The SSRF is triggered by submitting a crafted URL to the fetchLinkTitle function through the Link Title Fetch UI component; this feature must be accessible to the authenticated user. Impact is bounded by which network destinations the server-side fetch process can reach: exploitation is most severe when the host has access to cloud instance metadata services (e.g., AWS IMDSv1 without token enforcement), internal APIs, or RFC-1918 hosts. Deployments where the runtime is network-isolated or where metadata services enforce token-based access (IMDSv2) face significantly reduced risk.

The CVSS 4.0 score of 5.3 (Medium) reflects a meaningful but limited threat surface: network-accessible, low complexity, low privilege required, and limited impact across all three impact dimensions. The SSRF is constrained to what the server-side fetch process can reach, which in typical desktop AI agent deployments may include cloud metadata services (e.g., AWS IMDSv1) or internal APIs - elevated risk if the runtime has broad network access. No KEV listing and no public exploit code mean exploitation is not confirmed at scale; no EPSS data was provided. The sole reporting source is VulDB with no vendor corroboration, lowering confidence in affected-version precision. The vendor's failure to respond to disclosure is a moderate concern - it leaves users without an official patch and without confirmation of the vulnerability's actual exploitability boundaries. Overall this is a real but narrowly scoped risk: meaningful in cloud or networked deployments where metadata services are reachable, and low priority in air-gapped or purely localhost configurations.

An authenticated attacker with a valid hermes-agent session submits a crafted artifact URL pointing to an internal cloud metadata endpoint (e.g., http://169.254.169.254/latest/meta-data/) via the Link Title Fetch feature. The server-side fetchLinkTitle function issues the HTTP request without host validation, returning metadata contents - potentially including IAM role credentials - to the attacker. No public exploit code is required; the attack follows standard SSRF methodology.