CVE-2026-114463 in Hermes Agent
Summary
by MITRE • 10/21/2026
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated, which allows a remote attacker with the target HMAC to gain that higher-privileged route's toolsets.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in Nous Research Hermes Agent versions stems from an insecure handling of session identifiers within its webhook platform gateway architecture. The system constructs chat IDs for webhooks using a specific delimiter-based format, specifically combining the literal string webhook with the route name and delivery ID separated by colons. This design choice introduces a critical parsing flaw because the authorization mechanism relies on splitting this composite string to determine which route is being accessed. When an attacker can control or influence the content of the route name parameter, they can inject additional colon characters into the identifier. Because the system uses simple string splitting rather than robust tokenization that respects context boundaries, it misinterprets the structure of the chat ID. Specifically, if a legitimate route name contains a colon character, the parsing logic incorrectly segments the string at an unintended position. This causes the authorization module to associate the incoming request with a different route prefix than intended.
This structural ambiguity leads directly to a privilege escalation scenario where access control checks are bypassed or misapplied. The core issue is that the system derives the authorizing route by splitting the chat ID, assuming a fixed number of delimiters. When an attacker crafts a payload containing extra colons within the route name field, the split operation shifts the indices used to identify the target resource. Consequently, the security context associated with a lower-privileged or public route is incorrectly mapped to a higher-privileged internal route. This misalignment allows a remote attacker who possesses a valid HMAC signature for one endpoint to execute actions on another endpoint that requires significantly more elevated privileges. The attack does not require breaking cryptographic signatures but rather exploits the logical flaw in how those signatures are contextualized against resource paths.
From an operational perspective, this vulnerability compromises the integrity of toolset authorization within the Hermes Agent framework. Toolsets often represent powerful capabilities such as code execution, database access, or API interactions with sensitive data sources. By tricking the gateway into authorizing a request under a higher-privileged route prefix, an attacker can invoke tools that should be restricted to administrative or internal services only. This effectively grants unauthorized control over critical system functions, potentially leading to full compromise of the underlying infrastructure hosting the agent. The impact is severe because it allows lateral movement across privilege boundaries without needing additional authentication credentials beyond what was already obtained for a lower-level service.
This flaw aligns with CWE-697, which describes incorrect comparison during enforcement of access control, and falls under MITRE ATT&CK technique T1078, specifically relating to valid accounts being used in unintended ways or privilege escalation through misconfiguration. The root cause is rooted in CWE-20, improper input validation, where the system fails to sanitize or properly escape special characters like colons within dynamic route parameters before using them for security decisions. To mitigate this risk, developers must implement strict allow-listing of allowed characters for route names and avoid using delimiters that can be confused with structural separators in identifiers. Additionally, adopting a more robust serialization format such as JSON or base64 encoding for internal session IDs would prevent delimiter-based parsing attacks. Input validation should ensure that any user-controllable data used to construct security contexts is strictly validated against expected patterns before being processed by authorization logic.