Riskcovery

CVE-2026-18976

NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

State
Published
Severity
5.3 Medium
Published
Aug 6, 2026
Updated
Aug 6, 2026
Reserved
Aug 5, 2026

Read the record on cve.org

Description

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

Scores

CVSSScoreVectorSource
4.05.3 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:PVulDB
3.16.3 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
3.06.3 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:RVulDB
2.06.5 MediumAV:N/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:CVulDB

Weaknesses

  • CWE-266 Incorrect Privilege Assignment

Affected Products

ProductVersions
hermes-agentNousResearch
  • 0.1Affected
  • 0.2Affected
  • 0.3Affected
  • 0.4Affected
  • 0.5Affected
  • 0.6Affected
  • 0.7Affected
  • 0.8Affected
  • 0.9Affected
  • 0.10Affected
  • 0.11Affected
  • 0.12Affected
  • 0.13Affected
  • 0.14Affected
  • 0.15Affected
  • 0.16.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.