CVE-2026-10224: NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption
A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function handlewebhookrequest of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
nousresearch/hermes-agent (Feishu webhook component)from your environment.If the Feishu integration is not required, uninstall the hermes-agent or remove/disable the Feishu webhook component to eliminate the vulnerable code path (affects versions up to 2026.4.30).
- Configuration
Disable the Feishu webhook endpoint/handler (gateway/platforms/feishu.py::_handle_webhook_request) in hermes-agent instances (affects versions up to 2026.4.30) until a vendor-provided fix is available.
NousResearch hermes-agent (Webhook Endpoint: gateway/platforms/feishu.py::_handle_webhook_request) feishu_webhook_endpoint = disabled - Compensating control
Place the Feishu webhook endpoint behind a WAF or reverse proxy and enforce strict rate limiting and request size limits. Restrict access to the endpoint to trusted IP ranges or internal networks via firewall/ACLs to mitigate remote resource-consumption attempts.
- Operational
Monitor logs and telemetry for signs of exploitation of the Feishu webhook handler (resource exhaustion patterns), collect and retain relevant logs for incident response, block identified malicious sources, and await vendor advisories or patches before re-enabling the endpoint.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-10224?
CVE-2026-10224 has a medium severity rating of 5.3.
How do I fix CVE-2026-10224?
To fix CVE-2026-10224, update the NousResearch hermes-agent to the latest version released after 2026.4.30.
What is the impact of CVE-2026-10224?
CVE-2026-10224 can lead to excessive resource consumption due to manipulation of the webhook request.
Which component is affected by CVE-2026-10224?
CVE-2026-10224 affects the Webhook Endpoint function _handle_webhook_request in the feishu.py file.
What type of vulnerability is CVE-2026-10224?
CVE-2026-10224 is classified as a resource consumption vulnerability.