CVE-2026-14626

MEDIUM

NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service

Title source: cna
STIX 2.1

Description

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5
Core References
Third Party Advisory third-party-advisory
CVE-2026-14626 | CVE Analysis and Report
https://vuldb.com/cve/CVE-2026-14626
Third Party Advisory third-party-advisory
Submit #845596 | NousResearch Hermes Agent <= v2026.4.30 Insufficient Verification of Data Authenticity (CWE-345)
https://vuldb.com/submit/845596
Vdb Entry, Technical Description vdb-entry technical-description
VDB-376142 | NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
https://vuldb.com/vuln/376142
Signature, Permissions Required signature permissions-required
VDB-376142 | CTI Indicators (IOB, IOC, TTP, IOA)
https://vuldb.com/vuln/376142/cti

Scores

CVSS v3 4.3
EPSS 0.0028
EPSS Percentile 19.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-404
Status published
Products (31)
NousResearch/hermes-agent 2026.4.0
NousResearch/hermes-agent 2026.4.1
NousResearch/hermes-agent 2026.4.10
NousResearch/hermes-agent 2026.4.11
NousResearch/hermes-agent 2026.4.12
NousResearch/hermes-agent 2026.4.13
NousResearch/hermes-agent 2026.4.14
NousResearch/hermes-agent 2026.4.15
NousResearch/hermes-agent 2026.4.16
NousResearch/hermes-agent 2026.4.17
... and 21 more
Published Jul 04, 2026
Tracked Since Jul 04, 2026