CVE-2026-18976: Hermes-Agent Privilege Escalation Flaw

CVE-2026-18976 Overview

CVE-2026-18976 affects NousResearch hermes-agent versions up to and including 0.16.0. The vulnerability resides in the get_tool_definitions function within agent/agent_init.py, specifically in the disabled_toolsets handler. Manipulation of this component results in incorrect privilege assignment [CWE-266], allowing a low-privileged remote actor to influence which tool definitions are exposed to the agent. The issue was publicly disclosed and reported to the project through an issue tracker prior to CVE assignment.

Critical Impact
Remote actors with low privileges can bypass toolset restrictions in hermes-agent, exposing disabled tools to the agent runtime and expanding the effective attack surface of the AI agent.

Affected Products

NousResearch hermes-agent versions up to 0.16.0
Deployments using the disabled_toolsets configuration handler
Downstream projects embedding agent/agent_init.py from the affected releases

Discovery Timeline

2026-08-06 - CVE-2026-18976 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-18976

Vulnerability Analysis

The flaw sits inside get_tool_definitions in agent/agent_init.py. The function is responsible for assembling the tool definitions the agent may invoke, and it consults the disabled_toolsets handler to filter out toolsets an operator has explicitly disabled. Because the privilege assignment logic is incorrect, the function does not consistently honor the disabled state. Tools intended to be off-limits can still be enumerated or invoked through the agent interface.

In an AI agent runtime, tool definitions govern what actions the model can trigger. Weakening this boundary allows callers to reach functionality the operator intended to gate off, such as file access, shell execution, or external API calls exposed through additional toolsets. The vulnerability is reachable over the network and requires only low privileges to abuse.

Root Cause

The root cause is an [CWE-266] Incorrect Privilege Assignment defect. The disabled_toolsets handler is consulted during tool definition assembly, but the resulting privilege state is applied incorrectly. Tool entries that should have been suppressed remain reachable to the agent execution path. See the GitHub Issue #46171 and GitHub Pull Request #46185 for the upstream analysis and fix.

Attack Vector

An authenticated remote user interacts with the agent and triggers the tool enumeration path served by get_tool_definitions. Because disabled toolsets are not correctly filtered, the attacker gains access to tool capabilities the deployment intended to restrict. No user interaction beyond the attacker's own session is required. Public disclosure of the exploit means defenders should assume opportunistic reuse. For technical detail, refer to the VulDB entry for CVE-2026-18976.

Detection Methods for CVE-2026-18976

Indicators of Compromise

Agent audit logs showing invocation of tools listed under disabled_toolsets in the deployment configuration.
Unexpected calls to get_tool_definitions returning tool entries that should have been filtered.
Requests from low-privileged accounts producing tool actions previously reserved for administrators.

Detection Strategies

Compare the runtime set of tools returned to the agent against the intended disabled_toolsets configuration and alert on drift.
Instrument agent/agent_init.py with logging that records the caller identity, requested toolsets, and the final resolved tool list.
Correlate agent tool invocations with the privilege level of the initiating session to surface privilege boundary violations.

Monitoring Recommendations

Track outbound actions taken by the agent (file, shell, network) and baseline them against authorized toolsets per role.
Monitor version metadata of deployed hermes-agent instances and flag any still running 0.16.0 or earlier.
Alert on repeated tool enumeration requests from a single session, which may indicate probing of the disabled toolset boundary.

How to Mitigate CVE-2026-18976

Immediate Actions Required

Upgrade hermes-agent to a release later than 0.16.0 that includes the fix from GitHub Pull Request #46185.
Inventory all deployments referencing agent/agent_init.py and confirm the patched version is in place.
Rotate credentials or session tokens for low-privileged agent users if abuse of disabled toolsets is suspected.

Patch Information

The upstream fix is tracked in GitHub Pull Request #46185 against the NousResearch hermes-agent repository. Operators should pull a release built from a commit that includes this pull request and redeploy the agent runtime. Additional vulnerability metadata is available at VulDB Vulnerability #386264.

Workarounds

Restrict network access to the agent endpoint so only trusted, authenticated identities can reach get_tool_definitions.
Remove sensitive tool implementations from the deployment package rather than relying solely on disabled_toolsets for enforcement.
Run the agent under a least-privileged service account so any tool reached through the flaw operates within a constrained blast radius.

bash

# Configuration example: pin hermes-agent to a patched version
pip install --upgrade 'hermes-agent>0.16.0'

# Verify installed version
python -c "import importlib.metadata; print(importlib.metadata.version('hermes-agent'))"