PT-2026-55660 · Nousresearch · Hermes-Agent

Eric-A · Published 2026-07-03 · Updated 2026-07-03 · CVE-2026-14617

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 2026.4.31

Description An issue exists in the Streaming Reasoning Tag Filter component within the GatewayStreamConsumer. filter and accumulate() function located in the gateway/stream consumer.py file. This flaw results in the improper handling of case sensitivity, which can be triggered remotely. The attack complexity is high and exploitability is considered difficult.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-697

CWE-178

Related Identifiers

CVE-2026-14617

Affected Products

Hermes-Agent

References · 10

• 🔥 https://gist.github.com/YLChen-007/2229e5505bcbb3e15a7ae8fba4c4be37 · Exploit
• https://github.com/NousResearch/hermes-agent/pull/28631#issuecomment-4622188016 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-14617 · Security Note
• https://github.com/NousResearch/hermes-agent/issues/27288 · Note
• https://vuldb.com/vuln/376134/cti · Note
• https://vuldb.com/cve/CVE-2026-14617 · Note
• https://vuldb.com/vuln/376134 · Note
• https://github.com/NousResearch/hermes-agent · Note
• https://twitter.com/CVEnew/status/2073191209829388738 · Twitter Post
• https://vuldb.com/submit/844654 · Note