← Back to the live CVE advisory feed

CVE-2026-17432: hermes-agent

Severity

1.3 (LOW)

Vendor

NOUSRESEARCH

Affected versions

2026.6.5

Patch status

Unknown

Published

2026-07-26T01:16:25.783

Modified

2026-07-26T01:16:25.783

Why it matters

This matters because the affected product may be exposed on public websites. A vulnerable plugin can create a direct path to site compromise, malicious code deployment, or data theft.

Recommended admin actions

• Review during normal vulnerability triage unless the affected system is internet-facing or business-critical.
• Check whether the affected WordPress plugin or theme is installed.
• Update, disable, or remove the affected component if present.
• Treat internet-facing systems as higher priority.

Technical summary

A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.

View the official NVD record for CVE-2026-17432

CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.