PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9369 NousResearch CVE debrief

A local privilege issue exists in NousResearch hermes-agent 2026.4.23 within the CLI web-dashboard interface. The _discover_dashboard_plugins function in hermes_cli/web_server.py performs an incorrect comparison when processing the HERMES_ENABLE_PROJECT_PLUGINS argument, which could allow a local attacker to manipulate plugin loading behavior. The vulnerability requires local access and has been assigned a LOW severity CVSS score of 1.9. A proof-of-concept has been publicly disclosed. The vendor was reportedly contacted prior to disclosure but did not respond.

Vendor
NousResearch
Product
hermes-agent
CVSS
LOW 1.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-24
Original CVE updated
2026-07-23
Advisory published
2026-05-24
Advisory updated
2026-07-23

Who should care

Organizations running NousResearch hermes-agent 2026.4.23 with local multi-user access; security teams monitoring CLI web-dashboard deployments; developers maintaining hermes-agent installations with plugin functionality enabled

Technical summary

The _discover_dashboard_plugins function in hermes_cli/web_server.py of hermes-agent 2026.4.23 contains an incorrect comparison vulnerability (CWE-697) related to HERMES_ENABLE_PROJECT_PLUGINS argument handling. The flaw requires local access to exploit and could allow manipulation of plugin discovery behavior. Attack complexity is low with low privileges required, but impact is limited to local confidentiality, integrity, and availability impacts.

Defensive priority

low

Recommended defensive actions

  • Review local access controls on systems running hermes-agent 2026.4.23
  • Audit HERMES_ENABLE_PROJECT_PLUGINS environment variable usage
  • Monitor for unauthorized plugin loading attempts in hermes_cli/web_server.py
  • Apply vendor patches when available; consider restricting local access to the CLI web-dashboard interface
  • Review gist disclosure for defensive awareness of attack technique

Evidence notes

Vulnerability identified in hermes_cli/web_server.py within the _discover_dashboard_plugins function. CWE-697 (Incorrect Comparison) is the primary weakness classification. CVSS 4.0 vector: AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9369 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9369

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9369 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9369

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.