hermes-agent CVE-2026-9369

Requires authenticated local access (PR:L) to the system running hermes-agent 2026.4.23, specifically the ability to set environment variables for the hermes_cli web_server process. Exploitation targets the CLI web-dashboard interface feature - if this interface is not enabled or deployed, the vulnerability cannot be exploited. The attacker must be able to invoke or restart the hermes-agent web-dashboard with a manipulated HERMES_ENABLE_PROJECT_PLUGINS environment variable value. No remote network access is possible (AV:L strictly local). User interaction is not required (UI:N), meaning automated exploitation is feasible once local access is obtained. The attack complexity is low (AC:L), suggesting no race conditions or complex timing requirements. Exploitation is limited to environments where multiple users share access to the same hermes-agent installation or where an initial foothold has been established through other means.

Real-world risk is moderate-to-low for most environments. The CVSS base score of 5.3 (Medium) reflects the local attack vector (AV:L) requiring existing authenticated access (PR:L) but low attack complexity (AC:L) with no user interaction needed (UI:N). Impact is limited across confidentiality, integrity, and availability (C:L/I:L/A:L) with no scope change (S:U). The temporal metric E:P confirms a public proof-of-concept exists, increasing immediate exploitability. However, the local-only access requirement significantly constrains attack scenarios to situations where an adversary has already compromised a local account or has legitimate system access. The RL:X (remediation level unavailable) metric indicates no vendor patch exists, and vendor non-responsiveness suggests no fix is forthcoming. This makes the vulnerability a persistent risk for environments using this specific version. Without EPSS data or KEV listing, there is no evidence of active widespread exploitation. Priority should focus on environments where: (1) hermes-agent CLI web-dashboard is deployed in multi-user systems, (2) untrusted local users have access, or (3) the agent runs with elevated privileges. Organizations should assess whether this component is essential to operations given vendor abandonment signals.

An attacker with existing low-privilege local access to a system running hermes-agent 2026.4.23 sets or modifies the HERMES_ENABLE_PROJECT_PLUGINS environment variable before launching the CLI web-dashboard interface. The incorrect comparison logic in _discover_dashboard_plugins processes this manipulated value, causing the application to load unauthorized plugins or bypass intended plugin restrictions. This enables the attacker to access sensitive configuration data displayed in the dashboard (information disclosure) or inject malicious plugin code that executes with the privileges of the hermes-agent process (integrity/availability impact). Public proof-of-concept code is available demonstrating the exploitation technique.