CVE-2026-84287 in hermes-agent
Summary
by MITRE • 09/02/2026
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/api_server.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/07/2026
The vulnerability identified within NousResearch hermes-agent version 0.18.0 represents a significant security risk, specifically targeting the Session Chat Interface component through its file gateway mechanism located at platforms/api_server.py. This flaw is classified as a remote denial of service (DoS) vulnerability, which allows an attacker to disrupt the availability of the application without requiring authentication or prior access privileges. The core technical issue stems from improper handling of input data within the API server logic, where specific manipulations can trigger unhandled exceptions or resource exhaustion conditions that cause the service to crash or become unresponsive. This type of flaw is commonly associated with CWE-400, which describes resources not being properly controlled, leading to denial of service scenarios when external inputs are processed without adequate validation or error handling mechanisms.
The operational impact of this vulnerability is severe for any organization relying on hermes-agent for automated agent interactions or chat-based services. Since the attack vector is remote and does not require user interaction beyond sending a crafted request, it can be exploited by malicious actors to take down critical infrastructure components that depend on continuous availability. The fact that an exploit has already been published increases the immediacy of the threat landscape, as automated scanning tools and opportunistic attackers may actively probe for this specific weakness in exposed instances. This situation highlights a common challenge in open-source software maintenance where rapid feature deployment can outpace rigorous security auditing, leaving critical endpoints like API servers vulnerable to simple yet effective disruption techniques.
From an industry standard perspective, this vulnerability aligns with the MITRE ATT&CK framework technique T1499, Endpoint Denial of Service, which covers methods used by adversaries to disrupt or deny service to computing resources on a networked endpoint. The lack of response from the vendor further exacerbates the risk profile, as it leaves users without official patches or guidance for mitigation in the short term. Organizations running this version must assume that their systems are actively exploitable and should implement compensating controls immediately. These measures may include placing the service behind a Web Application Firewall (WAF) with rate limiting capabilities to mitigate flood-based attacks, restricting network access to trusted IP ranges only, or deploying custom input validation scripts at the proxy level before requests reach the vulnerable api_server.py module.
To address this issue comprehensively, administrators should prioritize upgrading to a patched version as soon as it becomes available from NousResearch. In the interim, monitoring logs for unusual spikes in request volume or specific error patterns associated with the file gateway can help detect active exploitation attempts. Additionally, implementing strict input sanitization and timeout configurations on the API server can reduce the window of opportunity for attackers to trigger the denial of service condition. It is also advisable to review other components within hermes-agent for similar vulnerabilities, as flaws in one area often indicate broader architectural weaknesses that could be leveraged by sophisticated adversaries seeking deeper access or more persistent disruption capabilities.