CVE-2026-114463: Hermes Agent 0 through 2026.8.19

Affected technology

Hermes Agent · 0 through 2026.8.19
Nous Research

Description’s affected range: versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string

Component: Not specified by the source

What an attacker can do

A remote attacker with the target HMAC can gain that higher-privileged route's toolsets.

Published 21-Oct-2026 16:37 UTC

KEV: no

Provenance

NVD CVE API 2.0 · Source record · observed 2026-10-21 16:36:47.356398+00:00 UTC

Stable permalink: https://cybercodered.org/item/cve-cve-2026-114463.html