PT-2026-55702 · Nousresearch · Hermes-Agent

Eric-A · Published 2026-07-04 · Updated 2026-07-04 · CVE-2026-14627

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent versions prior to 0.15.3

Description An improper authentication issue exists within the Discord Platform Integration component. The flaw is located in the DiscordAdapter. is allowed user() function within the gateway/platforms/discord.py file. This allows a remote attacker to bypass authentication, although the attack is characterized by high complexity and is difficult to exploit.

Recommendations Update NousResearch hermes-agent to a version newer than 0.15.2. As a temporary workaround, restrict access to the DiscordAdapter. is allowed user() function to minimize the risk of exploitation.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2026-14627

Affected Products

Hermes-Agent

References · 8

• 🔥 https://gist.github.com/YLChen-007/d030c690b10a97319efb129ca2f5badb · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-14627 · Security Note
• https://vuldb.com/submit/845598 · Note
• https://vuldb.com/vuln/376143 · Note
• https://twitter.com/infoflowcloud/status/2073448234601644375 · Twitter Post
• https://twitter.com/CVEnew/status/2073447445682368820 · Twitter Post
• https://vuldb.com/cve/CVE-2026-14627 · Note
• https://vuldb.com/vuln/376143/cti · Note