CVE-2026-82021CWE-494

CVE-2026-82021

High · published August 29, 2026

CVSS v3.1
8.3
EPSS
0%
Percentile
26.1
In the wild
Unconfirmed
What it is

Hermes Agent 0.18.2 prior to 0.19.0 contains a supply chain vulnerability in its bundled MCP catalog that allows a remote attacker to execute arbitrary code by compromising a third-party upstream repository referenced via a mutable branch rather than a pinned commit SHA. An attacker who compromises the upstream repository can propagate malicious code to every host that installs the affected catalog entry, with no further action required by the operator.

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
9.0 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
EPSS
0.00339 · 26.1th percentile
Weakness
CWE-494 · Download of Code Without Integrity Check
Published
2026-08-29T00:20Z
References (4)
https://github.com/NousResearch/hermes-agent/commit/9df5f879b4a5925c0f8f947e7e16ed8e845932c3 · [email protected]https://github.com/NousResearch/hermes-agent/pull/64463 · [email protected]https://github.com/NousResearch/hermes-agent/releases/tag/v2026.7.20 · [email protected]https://www.vulncheck.com/advisories/hermes-agent-mcp-catalog-supply-chain-rce-via-mutable-branch-reference · [email protected]
EPSS history
Timeline
  • 30 AUG 16:19Z
    EPSS moved — → 0%
    epss
  • 28 AUG 18:50Z
    Hermes Agent 0.18.2 < 0.19.0 MCP Catalog Supply Chain RCE via Mutable Branch Reference
    cvelistv5