CVE-2026-14617

Received Received - Intake

Improper Case Handling in NousResearch Hermes-Agent

Publication date: 2026-07-03

Last updated on: 2026-07-03

Assigner: VulDB

Description

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-03

Last Modified

2026-07-03

Generated

2026-07-04

AI Q&A

2026-07-04

EPSS Evaluated

N/A

NVD

CVE-2026-14617

EUVD

EUVD-2026-41654

Affected Vendors & Products

Vendor	Product	Version / Range
nousresearch	hermes-agent	to 2026.4.30 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-178	The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
CWE-697	The product compares two entities in a security-relevant context, but the comparison is incorrect.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the NousResearch hermes-agent, specifically in the function GatewayStreamConsumer._filter_and_accumulate within the Streaming Reasoning Tag Filter component. It involves improper handling of case sensitivity, which can be manipulated remotely by an attacker. The attack is considered complex and difficult to exploit.

Despite the vulnerability being publicly disclosed and potentially exploitable, the project has decided not to implement a dedicated fix due to maintenance cost considerations.

Impact Analysis

The vulnerability leads to improper handling of case sensitivity in a streaming component, which could allow a remote attacker to manipulate the system's behavior in unintended ways.

However, the impact is rated as low with a CVSS v3.1 base score of 3.1, indicating limited confidentiality impact and no impact on integrity or availability. The exploitability is difficult, and the attack complexity is high.

Hi! I’m here to help you understand CVE-2026-14617. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70