This vulnerability affects the _check_slash_access function in the gateway/run.py file of the Quick Command Handler component in NousResearch hermes-agent versions up to 2026.6.5. The flaw results in incorrect authorization, allowing remote attackers to potentially bypass access controls. The vulnerability has a CVSS 4.0 base score of 5.3, indicating medium severity. Exploit code is publicly available, increasing the risk of exploitation. The vendor has not provided any response or fix as of the publication date.

The incorrect authorization vulnerability allows remote attackers to bypass intended access controls in the hermes-agent software. This could lead to unauthorized actions or access within the affected component. The medium CVSS score reflects limited but significant impact due to the lack of required user interaction and low attack complexity. However, the absence of a vendor response or patch increases exposure risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch links are available, users should monitor official channels for updates. Until a fix is released, consider restricting network access to the affected hermes-agent service to trusted sources to reduce exposure.