CVE-2026-84288: NousResearch hermes-agent ACP Prompt Workflow session.py HermesACPAgent.prompt denial of service
A vulnerability has been found in NousResearch hermes-agent up to 0.18.2. This affects the function HermesACPAgent.prompt of the file acpadapter/session.py of the component ACP Prompt Workflow. Such manipulation leads to denial of service. The attack may be performed from remote. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
Does an attacker need to be authenticated or interact with a user?
The CVSS vector indicates low privileges are required, so this is not rated as exploitable by an entirely unauthenticated attacker. It can be exploited remotely over the network with low attack complexity and does not require user interaction.
What is the expected security impact beyond service disruption?
The reported impact is limited to availability: the CVSS vector assigns low availability impact and no confidentiality or integrity impact. The issue is therefore assessed as a denial-of-service condition rather than data exposure or modification.
Is exploit activity a realistic concern?
An exploit has been publicly disclosed, and the CVSS vector rates exploit code maturity as proof-of-concept. Systems that expose the affected workflow to remote, low-privileged users should be prioritized for review.