PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-14617 NousResearch CVE debrief

CVE-2026-14617 is a security vulnerability detected in NousResearch hermes-agent up to 2026.4.30. The affected function is GatewayStreamConsumer._filter_and_accumulate in the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely with high complexity and difficult exploitability. The project decided not to implement a dedicated fix due to maintenance cost concerns.

Vendor
NousResearch
Product
hermes-agent
CVSS
LOW 1.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-03
Original CVE updated
2026-07-03
Advisory published
2026-07-03
Advisory updated
2026-07-03

Who should care

Security teams and developers using NousResearch hermes-agent up to 2026.4.30 should be aware of this vulnerability. The vulnerability's impact and potential attack vectors should be evaluated. Affected systems should be reviewed for potential exposure.

Technical summary

The vulnerability is located in the GatewayStreamConsumer._filter_and_accumulate function of the gateway/stream_consumer.py file in the NousResearch hermes-agent. The issue arises from improper handling of case sensitivity in the Streaming Reasoning Tag Filter component. The vulnerability has a CVSS score of 1.3 and is rated as LOW severity. The attack vector is network-based with high complexity and requires low privileges.

Defensive priority

Given the low CVSS score and high complexity of exploitation, this vulnerability should be addressed but not considered a high priority. Review and monitor systems using NousResearch hermes-agent up to 2026.4.30 for potential exposure.

Recommended defensive actions

  • Review the affected function GatewayStreamConsumer._filter_and_accumulate in gateway/stream_consumer.py for case sensitivity issues.
  • Evaluate the system's exposure to remote attacks with high complexity.
  • Monitor for potential exploitation attempts of this vulnerability.
  • Consider implementing compensating controls to mitigate potential impacts.
  • Track vendor updates and potential future fixes for this issue.

Evidence notes

The CVE record and NVD detail provide official information on the vulnerability. Additional sources include Vuldb and various GitHub references. The project maintainers decided not to implement a dedicated fix due to maintenance cost concerns.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-14617 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-14617

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-14617 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-14617

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.