CVE-2026-14626 is a medium severity denial of service vulnerability affecting NousResearch hermes-agent up to version 2026.4.30. The vulnerability arises from improper handling of the 'todos' argument in the AIAgent.run_conversation function of the run_agent.py file, part of the HTTP API component. An attacker can remotely trigger this flaw to cause a denial of service condition. Although the exploit code has been publicly disclosed, there is no indication of known exploitation in the wild. The vendor has not provided any response or patch at the time of this report.

Successful exploitation results in denial of service, causing the affected hermes-agent service to become unavailable. This can disrupt operations relying on the agent's HTTP API. There is no indication of privilege escalation, data disclosure, or code execution associated with this vulnerability.

No official patch or remediation has been announced by the vendor. Since the vendor has not responded to disclosure and no fixes are available, users should consider implementing network-level protections such as restricting access to the hermes-agent HTTP API to trusted sources only. Monitor for unusual activity targeting the 'todos' argument. Stay alert for any future vendor advisories or patches addressing this issue.