CVE-2026-18775: NousResearch hermes-agent SSRF Vulnerability

CVE-2026-18775 Overview

CVE-2026-18775 is a server-side request forgery (SSRF) vulnerability [CWE-918] in NousResearch hermes-agent versions up to 0.16.0. The flaw resides in the browser_snapshot function within tools/browser_tool.py, part of the Browser Tooling component. An authenticated remote attacker can manipulate input to the function to coerce the agent into issuing HTTP requests to attacker-chosen destinations. Public disclosure of the exploit has occurred, and the vendor did not respond to early disclosure attempts. The vulnerability carries a CVSS 4.0 base score of 2.1 and an EPSS probability of 0.271%.

Critical Impact
An authenticated attacker can trigger outbound requests from the hermes-agent host, potentially reaching internal network resources, cloud metadata endpoints, or other services otherwise unreachable from the public internet.

Affected Products

NousResearch hermes-agent versions through 0.16.0
Component: Browser Tooling (tools/browser_tool.py)
Function: browser_snapshot

Discovery Timeline

2026-08-04 - CVE-2026-18775 published to NVD
2026-08-04 - Last updated in NVD database

Technical Details for CVE-2026-18775

Vulnerability Analysis

The hermes-agent project provides tooling that lets an AI agent drive browser automation and capture page snapshots. The browser_snapshot function in tools/browser_tool.py accepts a URL parameter and instructs the agent to fetch that resource. The function does not validate the destination against an allowlist, block private IP ranges, or restrict URL schemes. As a result, an attacker who can influence the URL argument can force the agent to send requests to arbitrary internal or external endpoints.

SSRF against an agent tool is particularly relevant in AI agent deployments, where the agent often runs inside a container or virtual machine with elevated network reachability. Requests originate from the trusted agent host rather than the attacker, bypassing perimeter controls.

Root Cause

The root cause is missing input validation on the URL supplied to browser_snapshot. The function trusts caller-supplied destinations and delegates the fetch to the underlying browser automation library without checking whether the target resolves to loopback addresses, RFC 1918 ranges, link-local addresses such as 169.254.169.254, or non-HTTP schemes.

Attack Vector

The attack is network-based and requires low privileges, meaning the attacker must be able to submit tool inputs to the agent. Typical exploitation involves invoking the browser tool with a URL pointing to an internal service such as http://127.0.0.1:8080/admin, a cloud metadata endpoint such as http://169.254.169.254/latest/meta-data/, or an internal RESTful API. The agent then performs the request and returns response data to the caller, exposing content that would otherwise be inaccessible.

No verified exploit code is published inline. Technical details and a proof of concept are available in the GitHub Gist PoC and the VulDB entry for CVE-2026-18775.

Detection Methods for CVE-2026-18775

Indicators of Compromise

Outbound HTTP requests from the hermes-agent process targeting private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses.
Requests to cloud instance metadata endpoints such as 169.254.169.254 or metadata.google.internal originating from the agent host.
Unexpected invocations of the browser_snapshot tool with URLs pointing to non-web assets, file schemes, or internal hostnames.

Detection Strategies

Instrument the browser_snapshot function to log every requested URL along with the calling identity and timestamp for offline review.
Deploy egress network monitoring that flags requests from AI agent workloads to internal address space or metadata services.
Correlate agent tool-invocation logs with network flow records to identify anomalous destinations tied to browser tooling calls.

Monitoring Recommendations

Baseline normal URL patterns invoked through the browser tool and alert on deviations, especially private or link-local addresses.
Forward agent execution logs and outbound proxy logs to a centralized data lake for retention and query.
Monitor for repeated failed fetches to internal endpoints, which often indicate SSRF probing.

How to Mitigate CVE-2026-18775

Immediate Actions Required

Restrict who can submit tool inputs to hermes-agent and disable the Browser Tooling component if it is not required.
Route agent outbound traffic through an egress proxy configured to deny requests to private and link-local ranges.
Block access to cloud metadata endpoints from the agent host using IMDSv2 enforcement, host firewall rules, or network policy.

Patch Information

At the time of publication, no fixed release from NousResearch is referenced in the advisory, and the vendor did not respond to disclosure. Monitor the VulDB vulnerability record #385785 and the project repository for a patched release beyond version 0.16.0.

Workarounds

Wrap browser_snapshot with a URL validator that enforces an allowlist of permitted hostnames and rejects non-https schemes.
Resolve target hostnames before fetching and reject any address in loopback, private, link-local, or multicast ranges.
Run the agent in a network namespace or container with egress limited to explicitly required external destinations.

bash

# Example egress restriction using iptables on the agent host
iptables -A OUTPUT -m owner --uid-owner hermes -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner hermes -d 169.254.0.0/16 -j REJECT