EUVD-2026-31560
GHSA-4j8w-8wvv-4969
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessNetwork scan for hermes-agent
-
DeliverySend crafted request to Batch Runner
-
ExploitBypass authorization checks
-
ExecutionExecute unauthorized batch commands
-
ImpactAccess sensitive data or modify agent behavior
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions - remote unauthenticated exploitation against default configurations of hermes-agent. The vulnerability requires only that the hermes-agent service be network-accessible and the Batch Runner component be active. No user interaction, authentication, or specific configuration is required for exploitation. |
| Impact | The CVSS 3.1 score of 7.3 indicates high severity with network-based, unauthenticated remote exploitation (AV:N/AC:L/PR:N/UI:N). The exploit code maturity is marked as Proof-of-Concept (E:P), and publicly available exploit code exists on GitHub. However, this vulnerability is not yet listed in CISA KEV, suggesting it may not be actively exploited at scale. The combination of low attack complexity, no required privileges, and available POC makes this a priority for patching, especially for internet-exposed instances. The vendor's lack of response to disclosure attempts raises concerns about patch availability timeline. |
| Exploit ScenarioDerived | An attacker identifies an internet-exposed hermes-agent instance and sends specially crafted requests to the Batch Runner component. By exploiting the missing authorization checks in check_all_command_guards, they execute unauthorized batch commands without authentication, potentially gaining control over agent operations or accessing sensitive data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – May 24, 2026
Missing authorization in NousResearch hermes-agent versions up to 2026.4.16 allows remote attackers to bypass authentication checks in the Batch Runner component, potentially executing unauthorized commands. The vulnerability affects the check_all_command_guards function in tools/approval.py and can be exploited without authentication. Publicly available exploit code exists, though the vulnerability is not yet confirmed in CISA KEV.
RemediationAI
No vendor-released patch identified at time of analysis. The vendor was contacted but did not respond, making official remediation guidance unavailable. As compensating controls, organizations should immediately restrict network access to hermes-agent instances behind firewalls or VPNs, implement additional authentication layers at the network perimeter, and monitor logs for unauthorized batch command executions. Consider disabling the Batch Runner component if not essential for operations. For detailed vulnerability information, refer to the VulDB entry at https://vuldb.com/vuln/365313.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the hermes-agent software developed by NousResearch, specifically in the Batch Runner component's authorization mechanism. The affected function check_all_command_guards in tools/approval.py fails to properly enforce access controls, falling under CWE-862 (Missing Authorization). This suggests the application processes batch commands without verifying whether the requesting user has appropriate permissions, allowing unauthorized actors to execute privileged operations.
Know when Hermes Agent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command_guards of the file tools/approval.py of the component Batch Runner. Such manipulation leads to missing authorization. The attack can be launched remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Executive ViewAI
NousResearch hermes-agent versions up to 2026.4.16 contain an authorization bypass in the Batch Runner component that allows unauthenticated remote attackers to execute unauthorized commands, creating immediate risk of system compromise for any deployment running affected versions. Organizations using this agent component should treat this as a critical operational vulnerability requiring urgent containment until a vendor patch is released.
No vendor-released patch identified at time of analysis. Interim mitigations: (1) Restrict network access to Batch Runner component to trusted hosts only via firewall/WAF rules; (2) Disable or remove the hermes-agent deployment from production until patch availability; (3) Implement application-level command validation and logging to detect unauthorized execution attempts; (4) Monitor API calls to tools/approval.py for suspicious patterns.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Related Vulnerabilities in NousResearch hermes-agent Security Flaws
View all 5More in Hermes Agent
View allRemote code execution in NousResearch Hermes Agent 0.18.2-0.21.0 allows an unauthenticated attacker to execute arbitrary
Remote command injection in NousResearch hermes-agent allows unauthenticated attackers to execute arbitrary OS commands
Path traversal in NousResearch hermes-agent (all versions through 2026.5.16) exposes arbitrary server-side files via the
Remote sandbox escape in NousResearch hermes-agent versions up to 2026.4.16 allows unauthenticated attackers to manipula
Path traversal in NousResearch hermes-agent 0.8.0 exposes arbitrary server-side files to unauthenticated remote attacker
Remote code/prompt injection in NousResearch Hermes Agent through 0.12.0 stems from improper neutralization in the _comp
Remote injection in NousResearch Hermes Agent through version 2026.4.30 allows unauthenticated attackers to manipulate t
Code injection in NousResearch hermes-agent 2026.4.23 allows remote unauthenticated attackers to inject and execute arbi
Uncontrolled resource consumption in NousResearch hermes-agent (all versions through 2026.4.30) allows remote unauthenti
Exploit-DB