CVE-2026-114463
Received
Received - Intake
Authentication Bypass in Nous Research Hermes Agent via Malicious Webhook Route
Vulnerability report for CVE-2026-114463, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: CERT/CC
Description
Description
The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a ":" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated, which allows a remote attacker with the target HMAC to gain that higher-privileged route's toolsets.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| Nous | Research | Hermes Agent 0 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
