CVE-2026-14628: Hermes-Agent Path Traversal Vulnerability

CVE-2026-14628 Overview

CVE-2026-14628 is a path traversal vulnerability affecting NousResearch hermes-agent versions up to 2026.5.16. The flaw resides in the extract_media function within gateway/platforms/base.py, part of the Live Webhook Endpoint component. Attackers can manipulate input to traverse directories and access files outside the intended path. The vulnerability is remotely exploitable without authentication or user interaction. A public exploit exists, and the vendor did not respond to disclosure attempts.

Critical Impact
Unauthenticated remote attackers can read arbitrary files on the host through crafted webhook requests, exposing sensitive data such as configuration files, credentials, and application source code.

Affected Products

NousResearch hermes-agent versions up to and including 2026.5.16
Component: Live Webhook Endpoint
Vulnerable function: extract_media in gateway/platforms/base.py

Discovery Timeline

2026-07-04 - CVE-2026-14628 published to NVD
2026-07-06 - Last updated in NVD database

Technical Details for CVE-2026-14628

Vulnerability Analysis

The vulnerability is a path traversal weakness classified under [CWE-22]. It resides in the extract_media function of the gateway/platforms/base.py module. This function is invoked by the Live Webhook Endpoint when processing incoming webhook payloads that reference media resources.

Because the function does not properly sanitize or canonicalize file path inputs, an attacker can supply crafted path segments such as ../ sequences. These segments allow the attacker to escape the intended media directory and reference arbitrary files on the underlying filesystem. The attack requires no authentication and is initiated over the network via the exposed webhook endpoint.

Successful exploitation results in disclosure of file contents accessible to the hermes-agent process. The confidentiality impact is limited to low per the CVSS 4.0 vector, but sensitive files such as .env, configuration files, or private keys used by the agent may be readable depending on deployment.

Root Cause

The root cause is missing input validation on the media path parameter parsed by extract_media. The function trusts client-supplied path components without enforcing that the resolved path remains within an allowlisted base directory. Standard defenses such as os.path.realpath boundary checks or rejection of .. sequences are absent.

Attack Vector

An attacker sends a malicious HTTP request to the Live Webhook Endpoint containing a media reference embedded with directory traversal sequences. The server-side handler passes this reference into extract_media, which resolves the path and reads the target file. The exploit is public, lowering the barrier to weaponization. See the GitHub PoC Repository and VulDB CVE-2026-14628 for technical details.

Detection Methods for CVE-2026-14628

Indicators of Compromise

Webhook request payloads containing ../, ..\, URL-encoded %2e%2e%2f, or double-encoded traversal sequences targeting the Live Webhook Endpoint
Access logs showing successful reads of files outside the expected media directory tree
Requests from external sources referencing sensitive filenames such as etc/passwd, .env, or private key paths

Detection Strategies

Inspect HTTP request bodies and query parameters routed to the hermes-agent webhook endpoint for path traversal patterns
Correlate extract_media invocations with the resolved absolute filesystem paths to identify access outside the media base directory
Deploy web application firewall rules that flag traversal patterns in JSON fields carrying media URIs or file references

Monitoring Recommendations

Enable verbose logging on the hermes-agent gateway platform module and forward logs to a centralized SIEM
Alert on file reads by the hermes-agent process outside its designated working directory
Monitor for outbound anomalies suggesting exfiltration of files read via the traversal flaw

How to Mitigate CVE-2026-14628

Immediate Actions Required

Restrict network exposure of the hermes-agent Live Webhook Endpoint to trusted upstream services only
Place the endpoint behind an authenticated reverse proxy or WAF that blocks traversal patterns
Audit the host filesystem to reduce readable content available to the service account running hermes-agent

Patch Information

No vendor patch is available at the time of publication. The vendor did not respond to disclosure attempts according to the NVD entry. Monitor the VulDB Vulnerability #376144 record and the upstream NousResearch repository for updated releases beyond version 2026.5.16.

Workarounds

Run hermes-agent under a low-privilege user account with filesystem access limited to the required media directory using OS-level sandboxing such as chroot, containers, or systemd ProtectSystem directives
Deploy a reverse proxy rule that rejects any request to the webhook path containing .., encoded traversal sequences, or absolute path prefixes
Disable the Live Webhook Endpoint if it is not required for the deployment

bash

# Example nginx rule to block traversal patterns targeting the webhook endpoint
location /webhook {
    if ($request_uri ~* "(\.\./|\.\.\\|%2e%2e%2f|%2e%2e/|\.\.%2f)") {
        return 403;
    }
    proxy_pass http://hermes_agent_upstream;
}