Which versions of hermes-agent are affected by CVE-2026-9350?

NousResearch hermes-agent versions up to 2026.4.16 contain an authorization bypass in the Batch Runner component that allows unauthenticated remote attackers to execute unauthorized commands,…

Is there a public PoC exploit available for CVE-2026-9350?

Yes, a public proof-of-concept exploit is available for CVE-2026-9350. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-9350?

Within 24 hours: Audit all systems running NousResearch hermes-agent versions ≤2026.4.16 and isolate affected instances from production networks. Within 7 days: Implement network-level restrictions to limit Batch Runner component exposure and disable the affected check_all_command_guards function in tools/approval.py if operationally feasible. Monitor for exploitation attempts. Within 30 days: Replace hermes-agent with a patched version immediately upon vendor release, or migrate to alternative solutions if patch timeline is unacceptable.

hermes-agent CVE-2026-9350

Q: What is the CVSS score of CVE-2026-9350?

CVE-2026-9350 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31560 MEDIUM

Missing Authorization (CWE-862)

2026-05-24 VulDB

GHSA-4j8w-8wvv-4969

Authentication Bypass Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

May 26, 2026 - 19:52 NVD

HIGH MEDIUM

CVSS changed

May 26, 2026 - 19:52 NVD

7.3 (HIGH) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 03:45 vuln.today

DescriptionCVE.org

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentication checks in the Batch Runner component, potentially executing unauthorized commands. The vulnerability affects the check_all_command_guards function in tools/approval.py and can be exploited without authentication. Publicly available exploit code exists, though the vulnerability is not yet confirmed in CISA KEV.

Technical ContextAI

The vulnerability resides in the hermes-agent software developed by NousResearch, specifically in the Batch Runner component's authorization mechanism. The affected function check_all_command_guards in tools/approval.py fails to properly enforce access controls, falling under CWE-862 (Missing Authorization). This suggests the application processes batch commands without verifying whether the requesting user has appropriate permissions, allowing unauthorized actors to execute privileged operations.

RemediationAI

No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond, making official remediation guidance unavailable. As compensating controls, organizations should immediately restrict network access to hermes-agent instances behind firewalls or VPNs, implement additional authentication layers at the network perimeter, and monitor logs for unauthorized batch command executions. Consider disabling the Batch Runner component if not essential for operations. For detailed vulnerability information, refer to the VulDB entry at https://vuldb.com/vuln/365313.