Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-29 · source-backed
CVE-2026-82021 (CVSS 9.0) covers Hermes Agent 0.18.2 through 0.19.0, where the bundled MCP catalog referenced a third-party upstream by branch name rather than commit SHA. Compromise the upstream and your code reaches every host installing that catalog entry, with zero operator action. The same batch includes CVE-2026-82020 (7.6), where ingested message content could overwrite the credential store because the sensitive-path guard excluded auth.json. Pinning is not optional in a catalog that executes what it fetches. (NVD)
Each link below shares sources, entities, or timing with this story.
Hermes Agent supports MCP / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, CVSS, MCP, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports MCP / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, CVSS, MCP; overlapping topics (auth, code, compromise).
Hermes Agent uses Claude / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent uses Claude); both cover CVE, CVSS, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports OpenAI / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports OpenAI); both cover CVE, CVSS, NVD; overlapping topics (agent, code, credential).
Hermes Agent supports MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, CVSS, MCP; overlapping topics (agent, code, credential).
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, CVSS, MCP; overlapping topics (action, agent, code).
Hermes Agent supports MCP / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, MCP, NVD; reported by the same outlet (nvd.nist.gov).
Hermes Agent supports MCP / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Hermes Agent supports MCP); both cover CVE, MCP, NVD; reported by the same outlet (nvd.nist.gov).