CVE-2026-18774 Overview
CVE-2026-18774 is a Server-Side Request Forgery (SSRF) vulnerability affecting NousResearch hermes-agent versions up to 0.16.0. The flaw resides in the save_url_image function within agent/image_gen_provider.py, part of the xAI Image Generation Provider component. An authenticated remote attacker can manipulate URL input to coerce the server into issuing arbitrary outbound HTTP requests. A public proof-of-concept has been released. The vendor was contacted prior to disclosure but did not respond. The weakness is classified under CWE-918: Server-Side Request Forgery.
Critical Impact
An authenticated attacker can abuse the image download routine to reach internal network resources, cloud metadata endpoints, or arbitrary external hosts through the hermes-agent service.
Affected Products
- NousResearch hermes-agent (versions up to and including 0.16.0)
- Component: xAI Image Generation Provider (agent/image_gen_provider.py)
- Affected function: save_url_image
Discovery Timeline
- 2026-08-04 - CVE-2026-18774 published to NVD
- 2026-08-05 - Last updated in NVD database
Technical Details for CVE-2026-18774
Vulnerability Analysis
The hermes-agent project exposes an image generation workflow that fetches remote images and saves them locally. The save_url_image function in agent/image_gen_provider.py accepts a URL parameter and issues a server-side HTTP request without validating or restricting the destination. Attackers with low privileges on the network-reachable service can supply URLs pointing at internal hosts, loopback interfaces, or cloud instance metadata services. The server retrieves the response on the attacker's behalf, producing a classic SSRF primitive. EPSS estimates exploitation probability at 0.201%.
Root Cause
The root cause is missing destination validation in save_url_image. The function trusts caller-supplied URLs and does not enforce an allowlist of schemes, hosts, or IP ranges. It also does not block redirects to private address space or link-local ranges such as 169.254.169.254. This omission maps directly to [CWE-918].
Attack Vector
Exploitation is remote and requires only low privileges. An attacker submits a crafted image URL through any input path that ultimately invokes save_url_image. The server performs the outbound request and may return content, headers, or timing signals that reveal internal service responses. This can be leveraged to enumerate internal services, retrieve cloud IAM credentials from metadata endpoints, or pivot into otherwise unreachable infrastructure. A working proof-of-concept is publicly available on GitHub Gist.
No verified sanitized exploit code is republished here. Refer to the VulDB advisory for CVE-2026-18774 for additional technical context.
Detection Methods for CVE-2026-18774
Indicators of Compromise
- Outbound HTTP requests originating from the hermes-agent process to internal RFC1918 ranges, 127.0.0.0/8, or 169.254.169.254.
- Image generation requests containing URL parameters pointing at non-image endpoints or unusual ports.
- Unexpected DNS resolutions from the agent host targeting internal hostnames.
- Anomalous access patterns to cloud instance metadata services correlated with agent activity.
Detection Strategies
- Instrument hermes-agent outbound traffic and alert on connections to private, loopback, or link-local address space.
- Review application logs for save_url_image invocations and compare requested URLs against expected image hosting domains.
- Deploy egress filtering that logs and blocks agent traffic to unauthorized destinations.
Monitoring Recommendations
- Forward web proxy and firewall telemetry covering the agent host into a centralized analytics platform for correlation.
- Monitor for cloud metadata API calls (/latest/meta-data/, IMDSv1 tokens) originating from workloads running hermes-agent.
- Track process-level network activity to identify SSRF pivots into internal services.
How to Mitigate CVE-2026-18774
Immediate Actions Required
- Restrict network egress from hosts running hermes-agent to an allowlist of required image hosting domains.
- Enforce IMDSv2 with hop-limit restrictions on cloud instances hosting the agent to prevent metadata credential theft.
- Require authentication and rate limiting on any interface that reaches the vulnerable image generation function.
- Audit historical logs for suspicious URLs submitted to save_url_image.
Patch Information
No vendor patch has been published. The vendor did not respond to disclosure attempts. Users should track the VulDB entry #385784 and the project repository for updates. Until a fix is available, treat any deployment of hermes-agent 0.16.0 or earlier as exposed.
Workarounds
- Wrap or replace save_url_image with a validator that resolves the target hostname and rejects private, loopback, link-local, and multicast IP ranges before issuing the request.
- Disable following HTTP redirects, or re-validate the destination after each redirect hop.
- Constrain the URL scheme to https and enforce an allowlist of trusted image hosting domains.
- Run the agent under a network policy that blocks access to cloud metadata endpoints and internal management planes.
# Example egress restriction using iptables to block metadata access from the agent host
iptables -A OUTPUT -m owner --uid-owner hermes -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 192.168.0.0/16 -j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
