CVE-2026-18976

MEDIUM 6.3

NousResearch hermes-agent disabled_toolsets agent_init.py get_tool_definitions privileges assignment

CVSS Score

6.3

EPSS Score

0.0%

EPSS Percentile

0th

A vulnerability was determined in NousResearch hermes-agent up to 0.16.0. This impacts the function get_tool_definitions of the file agent/agent_init.py of the component disabled_toolsets Handler. This manipulation causes incorrect privilege assignment. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report.

CWE	CWE-266
Vendor	nousresearch
Product	hermes-agent
Published	Aug 6, 2026

Stay Ahead of the Next One

Get instant alerts for nousresearch hermes-agent

Be the first to know when new medium vulnerabilities affecting nousresearch hermes-agent are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

NousResearch / hermes-agent

0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0.10 0.11 0.12 0.13 0.14 0.15 0.16.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

vuldb.com: https://vuldb.com/vuln/386264 vuldb.com: https://vuldb.com/vuln/386264/cti vuldb.com: https://vuldb.com/cve/CVE-2026-18976 vuldb.com: https://vuldb.com/submit/862541 github.com: https://github.com/NousResearch/hermes-agent/issues/46171 github.com: https://github.com/NousResearch/hermes-agent/pull/46185 github.com: https://github.com/NousResearch/hermes-agent/

Credits

🔍 Erichen-apple (VulDB User) VulDB CNA Team