CVE-2026-18773 Overview
CVE-2026-18773 is an incorrect authorization vulnerability in NousResearch hermes-agent versions up to 2026.6.5. The flaw resides in the _check_slash_access function within gateway/run.py, part of the Quick Command Handler component. An authenticated remote attacker with low privileges can manipulate the authorization check to access functionality that should be restricted. The vulnerability maps to [CWE-285: Improper Authorization]. A public proof-of-concept has been released, increasing the likelihood of opportunistic exploitation. The vendor was contacted before public disclosure but did not respond.
Critical Impact
Remote attackers with low-level authentication can bypass access controls in the Quick Command Handler, resulting in limited confidentiality, integrity, and availability impact on affected hermes-agent deployments.
Affected Products
- NousResearch hermes-agent versions up to and including 2026.6.5
- Component: Quick Command Handler (gateway/run.py)
- Function: _check_slash_access
Discovery Timeline
- 2026-08-04 - CVE-2026-18773 published to NVD
- 2026-08-04 - Last updated in NVD database
Technical Details for CVE-2026-18773
Vulnerability Analysis
The vulnerability affects the _check_slash_access function in gateway/run.py, which is responsible for validating access to slash commands handled by the Quick Command Handler component of hermes-agent. The function performs an incorrect authorization decision, allowing a remote user with low privileges to invoke commands that should require higher authorization. Because the flaw is in the authorization gate rather than in authentication, valid but low-privileged sessions can be leveraged to reach protected functionality. Exploitation is remote and does not require user interaction. The scope remains bounded to the vulnerable component, and impact on confidentiality, integrity, and availability is limited. A public proof-of-concept is available via GitHub Gist PoC Code, which lowers the barrier to reproduction.
Root Cause
The root cause is an improper authorization check inside _check_slash_access. The function evaluates access using logic that fails to fully enforce the intended policy for slash command execution. Classified under [CWE-285], this class of bug typically stems from missing role checks, flawed conditional logic, or trusting client-supplied identifiers when granting access.
Attack Vector
The attack vector is network-based. An attacker with valid low-privilege credentials sends a crafted request to the exposed hermes-agent gateway, invoking a slash command that reaches _check_slash_access. The flawed check returns an authorization decision favorable to the attacker, permitting execution. No user interaction is required. Refer to the VulDB CVE-2026-18773 Entry and the VulDB CTI for #385783 for additional technical context.
Detection Methods for CVE-2026-18773
Indicators of Compromise
- Unexpected slash command invocations from low-privileged accounts in hermes-agent gateway logs
- Successful command handler responses following requests that reference restricted commands
- Requests originating from external or non-administrative sources targeting gateway/run.py endpoints
Detection Strategies
- Audit access logs for the Quick Command Handler and correlate command execution against the invoking principal's expected privilege level
- Compare authorization outcomes against a baseline role-to-command matrix to surface anomalous approvals
- Instrument _check_slash_access with additional logging where source access is available, capturing user identity, requested command, and decision outcome
Monitoring Recommendations
- Forward hermes-agent gateway logs to a centralized analytics platform for continuous review of authorization decisions
- Alert on repeated slash command attempts from a single low-privileged identity within short time windows
- Track network traffic patterns to hermes-agent endpoints for spikes consistent with public PoC reproduction attempts
How to Mitigate CVE-2026-18773
Immediate Actions Required
- Restrict network exposure of hermes-agent gateway interfaces to trusted networks and administrative users only
- Enforce the principle of least privilege by removing unnecessary low-privilege accounts that can reach the gateway
- Monitor the NousResearch hermes-agent repositories for a patched release addressing _check_slash_access
Patch Information
At the time of publication, no vendor patch is available. The vendor was contacted before disclosure but did not respond. Track the VulDB Vulnerability #385783 entry and upstream project releases for remediation updates.
Workarounds
- Place hermes-agent behind an authenticated reverse proxy that enforces stricter role-based access controls on slash command paths
- Disable or gate the Quick Command Handler functionality where operationally feasible until a fixed version is released
- Apply network-level access control lists to limit which client identities can reach the gateway/run.py endpoints
# Example: restrict access to the hermes-agent gateway using firewall rules
# Allow only administrative subnet; block all other sources
iptables -A INPUT -p tcp --dport <hermes_agent_port> -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport <hermes_agent_port> -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
