CVE-2026-82021: Hermes Agent RCE Vulnerability

CVE-2026-82021 Overview

CVE-2026-82021 is a supply chain vulnerability in Hermes Agent versions 0.18.2 through 0.19.0. The flaw resides in the bundled Model Context Protocol (MCP) catalog, which referenced third-party upstream repositories by mutable branch names rather than pinned commit SHAs. An attacker who compromises an upstream repository can push malicious code that propagates to every host installing the affected catalog entry. No further operator action is required for the compromise to spread. The vulnerability is classified under CWE-494: Download of Code Without Integrity Check.

Critical Impact
Compromise of a single upstream repository can trigger unauthenticated remote code execution across all Hermes Agent hosts that install the affected MCP catalog entry.

Affected Products

Hermes Agent 0.18.2
Hermes Agent versions prior to 0.19.0
Hosts installing bundled MCP catalog entries referencing mutable branches

Discovery Timeline

2026-08-28 - CVE-2026-82021 published to NVD
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-82021

Vulnerability Analysis

Hermes Agent ships an MCP catalog that lists third-party servers users can install with hermes mcp install <name>. The catalog manifests referenced upstream repositories by mutable Git references such as branch names. Git branches are pointers that maintainers can update at any time, unlike commit SHAs which are content-addressed and immutable.

When an operator installs a catalog entry, Hermes Agent resolves the branch to whatever commit the upstream currently points to. An attacker who gains write access to any referenced upstream repository can force-push or merge malicious code, and every subsequent installation retrieves the attacker-controlled commit. The compromise requires user interaction only to trigger the initial install, which aligns with the UI:P component of the CVSS 4.0 vector.

Root Cause

The root cause is missing integrity verification on downloaded code. Manifests in the optional-mcps/ directory did not enforce exact version pins, so package launchers, git installs, and release tags could all resolve to mutable, attacker-controllable references. Trust in the catalog implicitly extended to third-party maintainers whose repositories could be compromised or hijacked.

Attack Vector

The attacker compromises an upstream repository referenced by the Hermes Agent MCP catalog. Compromise paths include stolen maintainer credentials, dependency confusion on the upstream, or a malicious pull request merge. The attacker then pushes malicious code to the branch that Hermes references. Any operator running hermes mcp install <name> retrieves and executes the malicious payload on the local host.

python

# Security patch in hermes_cli/mcp_catalog.py
# feat(mcp): enforce exact version pins across the whole MCP catalog

- Entries are added only by merging a PR into hermes-agent. Presence in the
  ``optional-mcps/`` directory = Nous approval. No community tier, no trust
  signals beyond "it's in the catalog".
- Manifests pin transport details (commands, args, refs). Pins follow the
  same supply-chain rules as pyproject dependencies: exact versions for
  package launchers (``uvx pkg==X``, ``npx pkg@X``), full commit SHAs for
  git installs, and the pinned release should be at least 2 weeks old at
  pin time. MCPs are never
  auto-updated; users explicitly re-run ``hermes mcp install <name>`` to
  pull a new manifest version after a repo update.

Source: GitHub commit 9df5f87

Detection Methods for CVE-2026-82021

Indicators of Compromise

Unexpected outbound network connections from processes spawned by hermes mcp install or MCP server binaries.
Manifest files in ~/.hermes/ or the optional-mcps/ directory referencing Git branches (for example main, master, develop) instead of full commit SHAs.
New or modified entries in ~/.hermes/.env immediately following an MCP install.
Child processes of Hermes Agent executing shell interpreters, package managers, or downloaders after installation.

Detection Strategies

Audit installed MCP manifests for any ref, commit, or version field that is not a full 40-character SHA or an exact package version.
Compare currently installed MCP commit hashes against the pinned SHAs published in Hermes Agent releases at v2026.7.20 or later.
Baseline process trees for hermes and alert on deviations such as new interpreters, compilers, or persistence writes.

Monitoring Recommendations

Forward endpoint process telemetry, DNS, and outbound flow logs from developer workstations running Hermes Agent to a centralized analytics platform.
Track integrity of upstream Git repositories referenced by any locally installed MCP catalog entries.
Alert on any invocation of hermes mcp install outside of approved change windows or from non-administrator accounts.

How to Mitigate CVE-2026-82021

Immediate Actions Required

Upgrade Hermes Agent to release v2026.7.20 or later, which enforces exact version pins across the MCP catalog.
Reinstall all MCP catalog entries after upgrade so pinned SHAs replace mutable references on disk.
Rotate any secrets stored in ~/.hermes/.env that may have been exposed to malicious MCP code.
Review Git logs of upstream repositories referenced by previously installed MCPs for unexpected commits during the exposure window.

Patch Information

The vendor released the fix in Hermes Agent release v2026.7.20. The catalog patch was merged in pull request #64463 and is documented in the VulnCheck advisory on the MCP catalog supply chain RCE. The patch enforces exact package versions for uvx and npx launchers, requires full commit SHAs for git installs, and mandates a two-week minimum age on pinned releases.

Workarounds

Do not run hermes mcp install for catalog entries whose manifests reference mutable branches until upgrading.
Manually edit local MCP manifests to substitute mutable refs with the current upstream commit SHA if immediate upgrade is not possible.
Restrict Hermes Agent execution to isolated developer environments without access to production credentials or networks.

bash

# Verify installed Hermes Agent version and audit MCP manifests for mutable refs
hermes --version
grep -R -E '"(ref|branch)"\s*:\s*"(main|master|develop|HEAD)"' ~/.hermes/ optional-mcps/ 2>/dev/null

# Upgrade to the patched release
pip install --upgrade 'hermes-agent>=2026.7.20'

# Reinstall catalog entries so pinned SHAs are written to disk
hermes mcp install <name>