This vulnerability affects the NousResearch hermes-agent software versions 0.1 through 0.16.0. It is caused by incorrect privilege assignment in the get_tool_definitions function of the agent/agent_init.py file, specifically in the disabled_toolsets Handler component. The flaw allows an attacker to manipulate privileges remotely. The issue was reported early to the project and has been publicly disclosed. The CVSS 4.0 base score is 5.3, indicating medium severity, with network attack vector, low attack complexity, no user interaction required, and limited impact on confidentiality, integrity, and availability. No official fix or patch has been documented in the provided data.

The vulnerability allows remote attackers to gain incorrect privileges within the affected component, potentially enabling unauthorized actions. The impact is rated medium severity with limited confidentiality, integrity, and availability impact. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is documented, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting network access to the affected service to trusted sources if feasible.