https://feed.craftedsignal.io/products/hermes-agent--2026.4.16/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 26 May 2026 13:46:59 +0000https://feed.craftedsignal.io/briefs/2026-05-cve-2026-9368/Tue, 26 May 2026 13:46:59 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-cve-2026-9368/A vulnerability in NousResearch hermes-agent up to version 2026.4.16 allows for remote exploitation of the execute_code function, leading to a sandbox escape.A remote code execution vulnerability, identified as CVE-2026-9368, exists in NousResearch hermes-agent versions up to 2026.4.16. The vulnerability resides within the execute_code function of the tools/code_execution_tool.py file, specifically affecting the Environment Variable Handler component. A publicly available exploit allows for remote attackers to bypass the intended sandbox restrictions. The vendor, NousResearch, was contacted but did not respond to the disclosure. This vulnerability poses a significant risk as it allows attackers to execute arbitrary code outside of the intended hermes-agent sandbox.

Attack Chain

1. Attacker identifies a vulnerable hermes-agent instance running a version up to 2026.4.16.
2. The attacker crafts a malicious request targeting the execute_code function in tools/code_execution_tool.py.
3. The request exploits the vulnerability in the Environment Variable Handler component.
4. The vulnerability allows the attacker to manipulate environment variables in a way that bypasses sandbox restrictions.
5. The attacker injects arbitrary code into the environment, leveraging the compromised environment variables.
6. The execute_code function executes the injected code, now running outside the intended sandbox.
7. The attacker gains unauthorized access to the underlying system.

Impact

Successful exploitation of CVE-2026-9368 allows a remote attacker to bypass the sandbox restrictions of hermes-agent, leading to arbitrary code execution on the host system. This can result in complete system compromise, data theft, or denial of service. The vulnerability is remotely exploitable and has a publicly available exploit, increasing the likelihood of exploitation.

Recommendation

• Monitor network traffic for requests targeting the execute_code function in tools/code_execution_tool.py to detect potential exploitation attempts using the Sigma rule provided.
• Implement input validation and sanitization for environment variables to mitigate the vulnerability in the Environment Variable Handler component.
• Apply network segmentation to limit the impact of a successful sandbox escape.
• Monitor process creation events for suspicious processes spawned by the hermes-agent process to detect potential post-exploitation activity using the Sigma rule provided.

]]>highadvisorysandbox-escaperemote-code-executioncvehttps://feed.craftedsignal.io/briefs/2026-05-cve-2026-9350-hermes-agent-auth-bypass/Tue, 26 May 2026 13:44:22 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-05-cve-2026-9350-hermes-agent-auth-bypass/A missing authorization vulnerability (CVE-2026-9350) exists in NousResearch hermes-agent up to version 2026.4.16, affecting the `check_all_command_guards` function in `tools/approval.py` of the Batch Runner component, enabling remote attackers to bypass authorization checks.A missing authorization vulnerability, identified as CVE-2026-9350, affects NousResearch hermes-agent up to version 2026.4.16. The flaw resides within the check_all_command_guards function in the tools/approval.py file, a part of the Batch Runner component. Successful exploitation of this vulnerability allows remote attackers to bypass authorization checks, potentially leading to unauthorized command execution or data access. Publicly available exploit code exists, increasing the risk of exploitation. The vendor was notified but has not responded. This vulnerability was published on 2026-05-24.

Attack Chain

1. Attacker identifies a vulnerable hermes-agent instance running a version prior to 2026.4.16.
2. The attacker crafts a malicious request targeting the Batch Runner component.
3. The request is designed to invoke functionality that relies on the check_all_command_guards function.
4. Due to the missing authorization check, the attacker bypasses the intended access controls.
5. The attacker executes unauthorized commands or accesses restricted data within the Batch Runner component.
6. The attacker leverages the unauthorized access to escalate privileges or gain further control over the system.
7. The attacker may install malware, exfiltrate sensitive data, or disrupt services.

Impact

Successful exploitation of CVE-2026-9350 can lead to unauthorized access to sensitive data, execution of arbitrary commands, and potential system compromise. This can result in data breaches, service disruption, and reputational damage. The fact that the exploit is publicly available increases the likelihood of widespread exploitation.

Recommendation

• Upgrade NousResearch hermes-agent to a version later than 2026.4.16 to remediate CVE-2026-9350.
• Monitor network traffic for suspicious requests targeting the Batch Runner component of hermes-agent using the “Detect Suspicious Hermes-Agent Batch Runner Requests” Sigma rule.
• Deploy the “Detect Unauthorized Command Execution via Hermes-Agent” Sigma rule to identify potential exploitation attempts.

]]>highadvisorycveauthorizationhermes-agent