CVE-2026-14626: Hermes-Agent Denial of Service via HTTP API Parameter Manipulation

Technical summary

CVE-2026-14626 is a denial of service vulnerability in the AIAgent.run_conversation function within hermes-agent's run_agent.py file. The flaw stems from improper handling of the 'todos' parameter in the HTTP API layer, classified as CWE-404 (Improper Resource Validation). The vulnerability is network-accessible and requires only low-privilege authentication (PR:L) to trigger, with no user interaction needed. Attack complexity is low, meaning the condition is straightforward to reproduce once an attacker has valid credentials.

Business impact

Organizations deploying hermes-agent risk service disruption attacks from insiders or compromised accounts with basic API access. In production environments relying on hermes-agent for conversational workflows, repeated exploitation could result in prolonged downtime affecting dependent applications or user-facing services. The impact is localized to availability rather than data confidentiality or integrity, but availability breaches can cascade through dependent systems.

Affected systems

NousResearch hermes-agent versions up to and including 2026.4.30 are vulnerable. The vulnerability exists in the HTTP API component, so any deployment exposing the run_conversation endpoint over a network is at risk. This includes cloud-hosted instances, containerized deployments, and on-premises installations where the API is accessible to authenticated users.

Exploitability

The exploit is straightforward and has already been disclosed publicly, meaning attack code or methodologies are likely available. Exploitation requires valid authentication credentials, which narrows the attacker pool to insiders, compromised accounts, or users with legitimate API access who act maliciously. No special tools or deep technical expertise are required—a simple HTTP request with a malformed 'todos' parameter will suffice. The low attack complexity means defenders should assume this will be tested quickly in live environments.

Remediation

Upgrade hermes-agent to a patched version beyond 2026.4.30. Verify the fix directly with NousResearch or check their official advisories, as the vendor has not yet responded to early disclosure attempts. Until patching is possible, restrict API access via network controls to trusted IP ranges and enforce strong authentication. Monitor for repeated failed or malicious API calls targeting the run_conversation endpoint.

Patch guidance

Apply the latest hermes-agent release available from NousResearch repositories. Given the vendor's non-responsiveness to early disclosure, prioritize communication with NousResearch support to confirm the availability and testing status of a fix. Deploy patches to a staging environment first to validate that conversation functionality remains intact. If a patched version is not yet available, isolate affected instances or implement firewall rules limiting API access to known-safe sources.

Detection guidance

Monitor HTTP logs for repeated requests to the run_conversation endpoint with unusual or oversized 'todos' parameter values. Set alerts for API errors or service restarts coinciding with such requests. In application logs, watch for exceptions or resource exhaustion events in the AIAgent.run_conversation function. Consider implementing rate limiting on the HTTP API to slow brute-force attempts to find exploitable input combinations.

Why prioritize this

Although the CVSS score is moderate (4.3), this vulnerability should not be deprioritized purely on that metric. The exploit is public, exploitation is trivial, and the vendor is unresponsive—creating a window of vulnerability without clear guidance or timelines. Any organization using hermes-agent should treat this as urgent for testing and patching, even though authentication is required. The straightforward nature of the attack means compromised or malicious insiders pose an immediate risk.

Risk score, explained

The CVSS 3.1 score of 4.3 (MEDIUM) reflects the low impact scope (availability only) and authentication requirement (PR:L). However, this score alone understates operational risk: public exploit availability, vendor non-engagement, and trivial attack complexity warrant fast response. The score appropriately penalizes the lack of confidentiality and integrity impact, but defenders must add context around the ease of exploitation and blast radius within their own user base.

Frequently asked questions