CVE-2026-14627

MEDIUM

NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication

Title source: cna

Description

A security vulnerability has been detected in NousResearch hermes-agent up to 0.15.2. This affects the function DiscordAdapter._is_allowed_user of the file gateway/platforms/discord.py of the component Discord Platform Integration. Such manipulation leads to improper authentication. The attack can be launched remotely. This attack is characterized by high complexity. The exploitability is reported as difficult. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-376143 | NousResearch hermes-agent Discord Platform Integration discord.py DiscordAdapter._is_allowed_user improper authentication

https://vuldb.com/vuln/376143

Signature, Permissions Required signature permissions-required

VDB-376143 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/376143/cti

Third Party Advisory third-party-advisory

CVE-2026-14627 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-14627

Third Party Advisory third-party-advisory

Submit #845598 | NousResearch Hermes Agent <= 75cbdfd06b Improper Authentication (CWE-287)

https://vuldb.com/submit/845598

Exploit exploit

https://gist.github.com/YLChen-007/d030c690b10a97319efb129ca2f5badb

Scores

CVSS v3 5.6

EPSS 0.0037

EPSS Percentile 29.6%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (3)

NousResearch/hermes-agent 0.15.0

NousResearch/hermes-agent 0.15.1

NousResearch/hermes-agent 0.15.2

Published Jul 04, 2026

Tracked Since Jul 04, 2026