Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-14617

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. Affected is the function GatewayStreamConsumer._filter_and_accumulate of the file gateway/stream_consumer.py of the component Streaming Reasoning Tag Filter. The manipulation leads to improper handling of case sensitivity. The attack may be initiated remotely. The attack's complexity is rated as high. The exploitability is told to be difficult. The exploit has been disclosed publicly and may be used. The pro
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:ca2846973d3c7961c20f53d5b45c91091ff8771e5e16884d86180a58ba8eb637
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
2

Preserved source conflicts

No provider value was silently selected as the winner.

cvss · 4 assertions

{"metric":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/2/cvssV3_0

{"metric":{"baseScore":2.3,"baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/0/cvssV4_0

{"metric":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/1/cvssV3_1

{"metric":{"baseScore":2.1,"vectorString":"AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}

  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/3/cvssV2_0
cwe · 2 assertions

{"cweId":"CWE-697","description":"Incorrect Comparison","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/problemTypes/1/descriptions/0

{"cweId":"CWE-178","description":"Improper Handling of Case Sensitivity","lang":"en","type":"CWE"}

  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/problemTypes/0/descriptions/0

Affected products and versions

1 source assertion
{"cpes":["cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*"],"modules":["Streaming Reasoning Tag Filter"],"product":"hermes-agent","vendor":"NousResearch","versions":[{"status":"affected","version":"2026.4.0"},{"status":"affected","version":"2026.4.1"},{"status":"affected","version":"2026.4.2"},{"status":"affected","version":"2026.4.3"},{"status":"affected","version":"2026.4.4"},{"status":"affected","version":"2026.4.5"},{"status":"affected","version":"2026.4.6"},{"status":"affected","version":"2026.4.7"},{"status":"affected","version":"2026.4.8"},{"status":"affected","version":"2026.4.9"},…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/affected/0

Provider-owned CVSS observations

4 source assertions
{"metric":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.0"},"metric_type":"cvssV3_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/2/cvssV3_0
{"metric":{"baseScore":2.3,"baseSeverity":"LOW","vectorString":"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P","version":"4.0"},"metric_type":"cvssV4_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/0/cvssV4_0
{"metric":{"baseScore":3.1,"baseSeverity":"LOW","vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N/E:P/RL:X/RC:C","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/1/cvssV3_1
{"metric":{"baseScore":2.1,"vectorString":"AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:ND/RC:C","version":"2.0"},"metric_type":"cvssV2_0"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/metrics/3/cvssV2_0

CWE assertions

2 source assertions
{"cweId":"CWE-697","description":"Incorrect Comparison","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/problemTypes/1/descriptions/0
{"cweId":"CWE-178","description":"Improper Handling of Case Sensitivity","lang":"en","type":"CWE"}
  • cve_program_cvelist_v5cwe
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/problemTypes/0/descriptions/0

Source references

9 source assertions
{"tags":["exploit"],"url":"https://gist.github.com/YLChen-007/2229e5505bcbb3e15a7ae8fba4c4be37"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/6
{"tags":["product"],"url":"https://github.com/NousResearch/hermes-agent/"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/7
{"tags":["issue-tracking"],"url":"https://github.com/NousResearch/hermes-agent/issues/27288"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/4
{"tags":["issue-tracking","patch"],"url":"https://github.com/NousResearch/hermes-agent/pull/28631#issuecomment-4622188016"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/5
{"name":"CVE-2026-14617 | CVE Analysis and Report","tags":["third-party-advisory"],"url":"https://vuldb.com/cve/CVE-2026-14617"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/2
{"tags":["exploit"],"url":"https://vuldb.com/submit/844654"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/adp/0/references/0
{"name":"Submit #844654 | Nous Research hermes-agent v2026.4.30 Improper Handling of Case Sensitivity Leading to Information Disclosure (CWE-178)","tags":["third-party-advisory"],"url":"https://vuldb.com/submit/844654"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/3
{"name":"VDB-376134 | NousResearch hermes-agent Streaming Reasoning Tag Filter stream_consumer.py GatewayStreamConsumer._filter_and_accumulate case sensitivity","tags":["vdb-entry","technical-description"],"url":"https://vuldb.com/vuln/376134"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/0
{"name":"VDB-376134 | CTI Indicators (IOB, IOC, IOA)","tags":["signature","permissions-required"],"url":"https://vuldb.com/vuln/376134/cti"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:2d538a3c33020e1708dbb8765b4e0c8af7c09505121a3b1ec8fac6295d75c594 · sha256:f1164f31d7bc8ecb… · /containers/cna/references/1

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer