CVE-2026-18976

The CVSS 6.3 on CVE-2026-18976 almost certainly understates this vulnerability. In a traditional application, 'incorrect privilege assignment' means a user sees a button they shouldn't click. In hermes-agent, disabled_toolsets represent a deliberate security boundary around expensive, sensitive, or dangerous operations—file system access, API key usage, external network calls. When get_tool_definitions bypasses those restrictions, it doesn't just violate a permission model; it invalidates the architectural decision to disable those tools in the first place. The critical distinction: in agentic systems, capability enumeration is not passive information disclosure. It's a roadmap the agent uses to plan. Even if tool invocation is theoretically blocked elsewhere, knowing what tools exist—and in what order, with what parameters—gives the agent a targeting list for probing attacks. The gap between 'I know SSH keys are accessible' and 'I have a plan to exfiltrate credentials' collapses to inference tokens, not network hops. For defenders: verify which version of hermes-agent you're running. If you're on 0.16.0 or earlier, check whether a later version contains the fix. Audit what your disabled_toolsets were meant to protect—cost controls, credential boundaries, network segmentation—and treat those assumptions as potentially compromised. The tool enumeration endpoint should require the same access controls as authentication; if get_tool_definitions is unauthenticated or trivially bypassed, that's your immediate remediation. One thing the CVSS doesn't capture: this vulnerability class has a documented history across OAuth token endpoints, AWS STS AssumeRole, and Kubernetes RBAC discovery paths. The pattern keeps recurring because the fix (authoritative capability gating at a single enforcement point) is architecturally simple but fights against the way developers implement 'disabled' flags as simple predicate checks rather than access control boundaries. Check your other agent frameworks for identical patterns in 'disabled' or 'hidden' tool flags—the odds of identical issues are higher than you'd expect.

Reviewed through automated stages and approved by a human before publication.