| Component | Hermes Agent |
| Severity | low (CVSS 3.1) |
| CVSS vector | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N |
| Published (NVD) | 2026-07-03 |
| Affected versions | not published yet, see the advisory |
| Fixed in | see the vendor advisory |
| Weakness | CWE-178CWE-697 |
| CISA KEV | not listed |
NVD description
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep Hermes Agent off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-14617
- https://gist.github.com/YLChen-007/2229e5505bcbb3e15a7ae8fba4c4be37
- https://github.com/NousResearch/hermes-agent/
- https://github.com/NousResearch/hermes-agent/issues/27288
- https://github.com/NousResearch/hermes-agent/pull/28631#issuecomment-4622188016
- https://vuldb.com/cve/CVE-2026-14617
- https://vuldb.com/submit/844654
- https://vuldb.com/vuln/376134
- https://vuldb.com/vuln/376134/cti
Other Hermes Agent CVEs
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allow...
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap...
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute...
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file app...
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the com...
A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acp_ad...