# CVE-2026-18773: NousResearch hermes-agent authorization bypass in slash commands

Source: https://junglewise.ai/threats/cve-2026-18773-nousresearch-hermes-agent-authorization-bypass-in-slash-commands  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-04. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-18773 · Severity: medium · CVSS 6.3 · Published 2026-08-04

Hermes Agent is a messaging gateway that manages access to administrative commands. A flaw in the authorization check for quick commands allows authenticated non-admin users to bypass admin-only restrictions and execute arbitrary shell commands on the gateway server. This can lead to unauthorized command execution and system compromise.

Technologies: [NousResearch Hermes Agent](https://junglewise.ai/threats/technologies/hermes-agent). Vendors: [NousResearch](https://junglewise.ai/threats/vendors/nousresearch).

## Quick answers

**Is CVE-2026-18773 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-18773 being exploited in the wild.

**How severe is CVE-2026-18773?** Medium severity, with a CVSS score of 6.3, published 4 August 2026.

**Which products and versions are affected?** NousResearch Hermes Agent up to 2026.6.5.

**Is there a fix for CVE-2026-18773?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-18773 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-18773?** Check whether you run NousResearch Hermes Agent at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authorization bypass in gateway/run.py where the _check_slash_access() function is applied only to registered gateway slash commands but not to operator-configured quick_commands. An authenticated non-admin user can craft a slash command matching a configured quick_command (e.g., /limits) to bypass the allow_admin_from and user_allowed_commands policy restrictions. When the quick_command is of type "exec", the attacker can trigger shell command execution in the gateway process context. The attack requires being an authenticated allowlisted non-admin user with messaging privileges. Public exploits are available.

## Affected products

- NousResearch hermes-agent up to 2026.6.5

## Timeline

- 2026-06-12: disclosed
- 2026-08-04: advisory

## References

- [https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645](https://gist.github.com/YLChen-007/f0036aa1c410b70f5e41272947180645)
- [https://vuldb.com/cve/CVE-2026-18773](https://vuldb.com/cve/CVE-2026-18773)

## Related threats

- [NousResearch hermes-agent resource exhaustion in resourceBufferFromUrl](https://junglewise.ai/threats/cve-2026-85107-nousresearch-hermes-agent-resource-exhaustion-in)
- [NousResearch hermes-agent server-side request forgery in Link Title Fetch](https://junglewise.ai/threats/cve-2026-85106-nousresearch-hermes-agent-server-side-request-forgery-in-link)
- [NousResearch hermes-agent authorization bypass in Session Management](https://junglewise.ai/threats/cve-2026-85105-nousresearch-hermes-agent-authorization-bypass-in-session)
- [NousResearch hermes-agent denial of service in MCP Tool](https://junglewise.ai/threats/cve-2026-84289-nousresearch-hermes-agent-denial-of-service-in-mcp-tool)
- [NousResearch hermes-agent denial of service in ACP Prompt Workflow](https://junglewise.ai/threats/cve-2026-84288-nousresearch-hermes-agent-denial-of-service-in-acp-prompt)