# CVE-2026-82021: Nous Research Hermes Agent supply chain vulnerability in MCP catalog

Source: https://junglewise.ai/threats/cve-2026-82021-nous-research-hermes-agent-supply-chain-vulnerability-in-mcp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-28. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-82021 · Severity: high · CVSS 8.3 · Published 2026-08-28

Hermes Agent is an AI agent framework that uses a catalog of third-party model context protocol (MCP) tools. Prior to version 0.19.0, the application referenced external code repositories using mutable branch names (like "main") instead of pinned commit hashes, allowing an attacker who compromises an upstream repository to inject malicious code that automatically propagates to all hosts installing that catalog entry without requiring user action.

## Quick answers

**Is CVE-2026-82021 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-82021 being exploited in the wild.

**How severe is CVE-2026-82021?** High severity, with a CVSS score of 8.3, published 28 August 2026.

**Which products and versions are affected?** Nous Research Hermes Agent 0.18.2 prior to 0.19.0.

**Is there a fix for CVE-2026-82021?** A patch was published on 2026-07-15: Version 0.19.0 released with exact version pin enforcement (commit 9df5f87) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-82021 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-82021?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a supply chain vulnerability rooted in insufficient dependency pinning in the MCP catalog manifest. The vulnerable component is the bundled catalog entries that reference third-party MCP repositories via mutable Git branches rather than immutable commit SHAs. The attack vector is network-based: an attacker with commit access to an upstream repository can push malicious code to a branch (e.g., "main") referenced by the Hermes Agent catalog. When operators install or update the affected catalog entry, the application automatically fetches and executes the poisoned code without further validation. The fix (version 0.19.0 and later) enforces exact version pinning: Git-based installs must use full 40-character commit SHAs, and package-based installs must use explicit version specifiers (e.g., pkg==X.Y.Z) rather than ranges or tags.

## Affected products

- Nous Research Hermes Agent 0.18.2 prior to 0.19.0

## Timeline

- 2026-08-28: disclosed: CVE-2026-82021 published
- 2026-07-15: patched: Version 0.19.0 released with exact version pin enforcement (commit 9df5f87)

## References

- [https://github.com/NousResearch/hermes-agent/commit/9df5f879b4a5925c0f8f947e7e16ed8e845932c3](https://github.com/NousResearch/hermes-agent/commit/9df5f879b4a5925c0f8f947e7e16ed8e845932c3)
- [https://github.com/NousResearch/hermes-agent/pull/64463](https://github.com/NousResearch/hermes-agent/pull/64463)