Description
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."
Published: 2026-07-03
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

Incomplete case-sensitive handling within the _filter_and_accumulate method of the Streaming Reasoning Tag Filter component allows a caller to supply tags that are not properly validated, effectively bypassing the intended filtering logic. The issue is classified as CWE-178, "Improper Case Conversion", and is also associated with CWE-697, "Incorrect Keystroke Timing or Sequence". The description indicates that remote actors can trigger the flaw; the complexity is high and the exploitability is considered difficult. The project has elected not to provide a dedicated fix, citing maintenance cost concerns.

Affected Systems

All deployments of NousResearch Hermes Agent that include the gateway/stream_consumer.py to and including 2026.4.30 are affected.

Risk and Exploitability

The reported CVSS score of 2.3 reflects a low severity rating. The EPSS score is reported as less than 1%, indicating a very low probability of real-world exploitation. The vulnerability can be initiated remotely but requires high effort and hard-to-reproduce conditions, and the vulnerability is not listed in the CISA KEV catalog. Consequently, the likelihood of active attacks is low, yet the impact of a bypass could be significant if the filtering is relied upon for policy enforcement.

Generated by OpenCVE AI on July 26, 2026 at 22:02 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Check for and install any newer releases that address the case-sensitivity issue; if no fix is known, consider alternative mitigations.
  • If upgrading is not possible, modify the GatewayStreamConsumer._filter_and_accumulate function to enforce strict case-sensitive comparison when validating tags, thereby restoring the intended filtering behavior.
  • Restrict access to the streaming interface so that only authenticated and authorized users can submit data, and enable detailed logging of all tag-processing activity to detect any attempts to bypass the filter.

Generated by OpenCVE AI on July 26, 2026 at 22:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 06 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 03 Jul 2026 22:00:00 +0000

Type Values Removed Values Added
Description A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The project decided to not implement a dedicated fix: "[T]he analysis and the fix are both sound. It just lands below the bar for the maintenance cost of a duplicated scrub path."
Title NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity
First Time appeared Nousresearch
Nousresearch hermes-agent
Weaknesses CWE-178
CWE-697
CPEs cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*
Vendors & Products Nousresearch
Nousresearch hermes-agent
References
Metrics cvssV2_0

{'score': 2.1, 'vector': 'AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 3.1, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 3.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-06T19:40:14.670Z

Reserved: 2026-07-03T16:31:16.337Z

Link: CVE-2026-14617

cve-icon Vulnrichment

Updated: 2026-07-06T19:39:52.185Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T22:15:05Z

Weaknesses
  • CWE-178

    Improper Handling of Case Sensitivity

  • CWE-697

    Incorrect Comparison