The Hermes Agent webhook gateway constructs a session chat_id using the pattern webhook:{route_name}:{delivery_id} and then re‑derives the authorizing route by splitting that string. This flaw is a CWE‑284 vulnerability (improper access control). An attacker who supplies a route name that contains a colon causes the split to produce a higher‑privileged prefix, thereby bypassing the normal route‑based authorization. With a valid target HMAC the attacker can obtain the toolsets associated with that privileged route, enabling unauthorized access to higher‑privileged resources.

The vulnerability affects Nous Research Hermes Agent versions prior to 0.22.2. Releases before the v0.22.2 update, as documented in pull request 115285, contain the route‑name parsing logic that allows the colon‑based bypass.

Exploitation requires remote submission of a webhook with a crafted route name and possession of a valid target HMAC. The flaw resides in the gateway logic, so a remote attacker can trigger it from any client that can send a webhook request. The EPSS score is not available, and the CVE is not listed in the CISA KEV catalog, but the unauthorized elevation of privilege and access to toolsets aligns with a high‑severity risk.