{"id":"CVE-2026-114463","kind":"vulnerability","aliases":["CVE-2026-114463"],"related":[],"title":"Hermes Agent: webhook route names with colons escalate toolset privileges","description":"The webhook platform gateway in Nous Research Hermes Agent versions builds the session chat_id as webhook:{route_name}:{delivery_id} and re-derives the authorizing route by splitting that string, so a route name containing a \":\" resolves toolset authorization to a different, higher-privileged prefix route than the one authenticated, which allows a remote attacker with the target HMAC to gain that higher-privileged route's toolsets.","summary":"Hermes Agent's webhook gateway builds session IDs from the route name and delivery ID, then re-derives the authorizing route by splitting that string on colons. A route name containing a colon can be matched to a different, higher-privileged route, so a remote attacker holding the target's HMAC secret can gain that route's toolsets.","severity":"unknown","cvss":null,"epss":0.00366,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ai-tooling","hermes-agent","nous-research","self-hosted","webhooks"],"not_affected_if":["single-route-config","webhook-gateway-disabled"],"how_to_check":"- unknown","fix":"- unknown","status":"open","published_at":"2026-10-21T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","triaged_at":"2026-10-25T05:02:04+00:00","updated_at":"2026-10-25T05:02:04+00:00","category":"ai-tooling","confidence":0.6,"triage":{"at":"2026-10-25T05:02:04Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"Hermes Agent: webhook route names with colons escalate toolset privileges","impact":"high","summary":"Hermes Agent's webhook gateway builds session IDs from the route name and delivery ID, then re-derives the authorizing route by splitting that string on colons. A route name containing a colon can be matched to a different, higher-privileged route, so a remote attacker holding the target's HMAC secret can gain that route's toolsets.","category":"ai-tooling","nicknames":[],"who_cares":["hermes-agent","nous-research","webhooks","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker gains a higher-privileged route's agent toolsets remotely.","analyst_note":"Check the NVD entry and the Hermes Agent repository advisory for affected and fixed versions, and for the route configuration needed to reproduce.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["webhook-gateway-disabled","single-route-config"],"who_is_affected":"Deployments of Hermes Agent that expose the webhook platform gateway and define several webhook routes with differing privileges, where an attacker holds a route's HMAC secret. Installations that do not enable the webhook gateway, or that use only one route, are less exposed. The sources do not say which versions are fixed.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000595,"input_tokens":3388,"output_tokens":513,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-114463':13A,16A '-2026':12A,15A 'agent':2A,22B,31B,98C 'ai':18B 'ai-tool':17B 'allow':144C 'attack':77B,147C 'authent':142C 'author':50B,116C,130C 'build':35B,100C 'chat':103C 'colon':7A,57B,63B 'contain':61B,126C 'cve':11A,14A 'deliveri':43B,109C 'deriv':48B,114C 'differ':69B,133C 'escal':8A 'gain':85B,153C 'gateway':34B,93C 'herm':1A,21B,30B,97C 'hermes-ag':20B 'higher':71B,135C,156C 'higher-privileg':70B,134C,155C 'hmac':82B,151C 'hold':78B 'host':28B 'id':37B,44B,104C,110C 'match':66B 'name':5A,41B,60B,108C,125C 'nous':24B,95C 'nous-research':23B 'one':141C 'platform':92C 'prefix':137C 'privileg':10A,72B,136C,157C 're':47B,113C 're-der':46B,112C 'remot':76B,146C 'research':25B,96C 'resolv':128C 'rout':4A,40B,51B,59B,73B,87B,107C,117C,124C,138C,158C 'secret':83B 'self':27B 'self-host':26B 'session':36B,102C 'split':53B,119C 'string':55B,121C 'target':80B,150C 'tool':19B 'toolset':9A,89B,129C,160C 'version':99C 'webhook':3A,29B,33B,91C,106C","nicknames":[],"mitigations":[],"who_affected":"Deployments of Hermes Agent that expose the webhook platform gateway and define several webhook routes with differing privileges, where an attacker holds a route's HMAC secret. Installations that do not enable the webhook gateway, or that use only one route, are less exposed. The sources do not say which versions are fixed.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114463","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114463","severity":null,"published_at":"2026-10-21T16:17:34+00:00","modified_at":"2026-10-22T17:40:46+00:00","first_seen_at":"2026-10-23T21:57:29+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114463","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114463","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}