hermes-agent CVE-2026-9352

Remote exploitation against default configurations of NousResearch hermes-agent. No authentication required (PR:N). No user interaction needed (UI:N). Requires the Messaging Gateway Handler component to be network-accessible and the vulnerable _make_run_env function in tools/environments/local.py to be reachable via API endpoints. Attack complexity is low (AC:L), suggesting no special timing, race conditions, or environmental factors needed beyond basic network connectivity to the hermes-agent service. Exploitation is limited to information disclosure only - attacker cannot modify system state (I:N) or disrupt availability (A:N) through this vulnerability alone.

CVSS 5.3 (Medium) with vector AV:N/AC:L/PR:N/UI:N indicates network-accessible exploitation requiring no authentication or user interaction, but limited to confidentiality impact (C:L) with no integrity or availability consequences. The E:P temporal metric confirms proof-of-concept exploit code exists and is publicly accessible via GitHub Gist. However, RL:X (remediation level unavailable) indicates no vendor patch, which significantly elevates operational risk. The low attack complexity combined with no authentication requirement makes this trivially exploitable despite the moderate CVSS score. Real-world risk is elevated by three factors: (1) public exploit code lowers attacker skill requirements, (2) vendor non-responsiveness suggests no imminent fix, and (3) information disclosure in AI agent frameworks could expose API keys, model configurations, or internal routing information valuable for supply chain attacks. Without EPSS or KEV data, we cannot confirm active exploitation, but the public POC and vendor silence suggest defenders should prioritize assessment over waiting for official guidance.

An attacker identifies a publicly accessible hermes-agent deployment by scanning for characteristic API endpoints or service banners. Using the publicly available exploit code from GitHub Gist, they craft HTTP requests targeting the Messaging Gateway Handler that invoke the vulnerable _make_run_env function in tools/environments/local.py. The function improperly returns environment configuration details including API keys, model endpoints, internal network paths, or authentication tokens embedded in runtime variables. The attacker harvests this information to pivot into deeper infrastructure access, compromise connected AI models, or exfiltrate training data repositories.