| Component | Hermes Agent |
| Severity | medium (CVSS 4.3) |
| CVSS vector | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L |
| Published (NVD) | 2026-09-01 |
| Last modified | 2026-09-02 |
| Affected versions | not published yet, see the advisory |
| Fixed in | see the vendor advisory |
| Weakness | CWE-404 |
| CISA KEV | not listed |
NVD description
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
What to do
- NVD lists no fixed version yet: follow the vendor advisory below and keep Hermes Agent off the public internet until a fix ships.
- Do not expose the component's API or UI to the internet without authentication in front of it.
Sources
- NVD: CVE-2026-84287
- https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report
- https://vuldb.com/cve/CVE-2026-84287
- https://vuldb.com/submit/882712
- https://vuldb.com/submit/882795
- https://vuldb.com/vuln/397718
- https://vuldb.com/vuln/397718/cti
Other Hermes Agent CVEs
9router 0.4.1 through 0.5.99 contains a configuration injection vulnerability in the POST /api/cli-tools/hermes-settings endpoint that allow...
Hermes Agent 0.18.2 through 0.21.0, fixed in commit f6234d0, contains a remote code execution vulnerability that allows attackers to execute...
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the com...
A vulnerability was found in NousResearch hermes-agent 0.18.0. This vulnerability affects the function resourceBufferFromUrl of the file app...
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/ap...
A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mc...