Is there a public PoC exploit available for CVE-2026-9352?

Yes, a public proof-of-concept exploit is available for CVE-2026-9352. Prioritise patching immediately. EPSS: 0.0%.

hermes-agent CVE-2026-9352

Q: What is the CVSS score of CVE-2026-9352?

CVE-2026-9352 has a CVSS 4.0 base score of 5.5 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-31564 MEDIUM

Information Exposure (CWE-200)

2026-05-24 VulDB

GHSA-8r48-r96c-p95w

Information Disclosure Hermes Agent

5.5

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

May 26, 2026 - 19:52 NVD

5.3 (MEDIUM) 5.5 (MEDIUM)

Analysis Generated

May 24, 2026 - 05:16 vuln.today

DescriptionCVE.org

A weakness has been identified in NousResearch hermes-agent up to 2026.4.23. This issue affects the function _make_run_env of the file tools/environments/local.py of the component Messaging Gateway Handler. Executing a manipulation can lead to information disclosure. The attack may be launched remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

AnalysisAI

Information disclosure in NousResearch hermes-agent allows remote unauthenticated attackers to extract sensitive data via crafted requests to the Messaging Gateway Handler's environment configuration function. The vulnerability affects versions up to 2026.4.23 with publicly available exploit code demonstrating the attack. EPSS data not provided, but public POC availability increases immediate risk. Vendor has not responded to disclosure, suggesting no official patch timeline.

Technical ContextAI

The vulnerability resides in the _make_run_env function within tools/environments/local.py, which handles environment configuration for the Messaging Gateway Handler component of hermes-agent. The affected product (CPE: cpe:2.3:a:nousresearch:hermes-agent) is an AI agent framework from NousResearch. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor), indicating the function improperly exposes environment variables, configuration details, or internal system information that should remain protected. The Messaging Gateway Handler likely processes incoming agent communication requests, and the _make_run_env function appears responsible for setting up execution contexts with access to potentially sensitive runtime configuration.

RemediationAI

No official vendor patch is available as NousResearch has not responded to vulnerability disclosure. Organizations running hermes-agent <=2026.4.23 should implement the following compensating controls in order of priority: (1) Restrict network access to the Messaging Gateway Handler using firewall rules or network segmentation to trusted IP ranges only, reducing AV:N to AV:A; trade-off is reduced agent accessibility for legitimate remote clients. (2) Implement authentication proxy or API gateway in front of hermes-agent endpoints to enforce PR:L/PR:H requirements, though this may break existing integrations expecting unauthenticated access. (3) Review tools/environments/local.py code (specifically _make_run_env function) to identify exposed environment variables and sanitize or remove sensitive data from runtime environment; this requires code modification skills and introduces maintenance burden for future updates. (4) Monitor logs for unusual queries to environment configuration endpoints using patterns from the public exploit (https://gist.github.com/YLChen-007/760b3940f708990e535214529c0c7a27). Consider migrating to alternative AI agent frameworks with active security maintenance if NousResearch remains unresponsive.