CVE-2026-114463

UNKNOWN 0.0

CVE-2026-114463

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated, which allows a remote attacker with the target HMAC to gain that higher-privileged route's toolsets.

Vendor	nous research
Product	hermes agent
Published	Oct 21, 2026
Last Updated	Oct 21, 2026

Stay Ahead of the Next One

Get instant alerts for nous research hermes agent

Be the first to know when new unknown vulnerabilities affecting nous research hermes agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Nous Research / Hermes Agent

0 ≤ 2026.8.19

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/NousResearch/hermes-agent/pull/115285 github.com: https://github.com/NousResearch/hermes-agent/releases/tag/v0.22.2 github.com: https://github.com/pinarsadioglu/security-advisories/blob/main/webhook-route-authz-bypass.md