CVE-2026-85106 in hermes-agent
Summary
by MITRE • 09/03/2026
A vulnerability has been found in NousResearch hermes-agent 0.18.0. This affects the function fetchLinkTitle of the file apps/desktop/src/app/artifacts/index.tsx of the component Link Title Fetch. Such manipulation of the argument url leads to server-side request forgery. The attack can be launched remotely. The vendor was contacted early about this disclosure but did not respond in any way.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/03/2026
The discovery of a Server-Side Request Forgery vulnerability within NousResearch hermes-agent version 0.18.0 represents a significant security risk for deployments utilizing the Link Title Fetch component. This specific flaw resides in the fetchLinkTitle function located at apps/desktop/src/app/artifacts/index.tsx, where the application fails to adequately validate or restrict user-supplied input passed as the url argument. By manipulating this parameter, an attacker can induce the server-side agent to initiate HTTP requests to arbitrary destinations controlled by the adversary rather than solely fetching titles from intended external resources. This lack of proper output validation and URL restriction allows for a classic SSRF attack vector, where the application acts as a proxy for malicious network traffic originating from the backend infrastructure.
From an operational perspective, this vulnerability enables remote attackers to exploit internal network services that may not be directly accessible from the public internet. The primary impact involves unauthorized access to sensitive internal resources such as cloud metadata endpoints, internal API servers, or database management interfaces. Attackers can leverage this capability to exfiltrate data stored on local hosts, bypass firewalls and web application filters by making requests appear to originate from trusted internal systems, and potentially pivot further into the network infrastructure. The severity is compounded by the fact that the attack can be launched remotely without requiring prior authentication in many configurations, depending on how the hermes-agent interface exposes this functionality to end users or other services.
The technical classification of this flaw aligns with CWE-918, which defines Server-Side Request Forgery as a vulnerability where a web server retrieves a specified resource from a user-supplied URL without validating that request. This misconfiguration violates the principle of least privilege and proper input sanitization standards expected in secure software development lifecycles. Furthermore, this behavior maps to MITRE ATT&CK technique T1571, which covers Non-Standard Ports and protocols often used in SSRF attacks to evade detection by standard security monitoring tools that may not inspect outbound traffic on less common ports or for specific internal domains. The ability to force the server to make requests effectively turns the application into a tool for network reconnaissance and data theft against adjacent systems within the same trust boundary.
The vendor's lack of response to early disclosure attempts raises concerns regarding the timeliness of potential patches, leaving users exposed during an extended window of vulnerability. In the absence of an official patch or configuration update from NousResearch, immediate mitigation strategies must be implemented by system administrators and security teams responsible for these deployments. The most effective remediation involves implementing strict allow-lists for outbound network connections at both the application level and the infrastructure level. Application-level fixes should enforce rigorous validation on the url parameter to ensure it only points to expected domains or IP ranges, rejecting any requests targeting private address spaces such as 10.x.x.x, 172.16-31.x.x, or 192.168.x.x, as well as localhost addresses like 127.0.0.1 and ::1.
Infrastructure-level mitigations are equally critical to provide defense in depth. Network security controls such as firewalls and proxy servers should be configured to block outbound connections from the hermes-agent host to internal network segments that do not require external access. Additionally, implementing egress filtering rules that restrict traffic to only known and necessary endpoints can significantly reduce the attack surface. Organizations running this version of hermes-agent are advised to monitor their network logs for anomalous outbound connection attempts originating from the affected server, particularly those targeting unusual ports or internal IP addresses. Until a vendor-provided fix is available, these compensating controls serve as the primary means of protecting sensitive infrastructure from exploitation via this SSRF vulnerability.