This vulnerability affects the NousResearch hermes-agent software versions up to and including 0.16.0. It is located in the get_tool_definitions function of the agent/agent_init.py file, specifically in the disabled_toolsets Handler component. The flaw causes incorrect privilege assignment, potentially allowing an attacker to gain elevated privileges remotely. The vulnerability has a CVSS 4.0 base score of 5.3 (medium severity), indicating network attack vector, low attack complexity, no privileges required, no user interaction, and low impacts on confidentiality, integrity, and availability. The issue was responsibly disclosed to the project early, and public exploit information exists. No vendor advisory or patch information is currently provided.

An attacker can remotely exploit this vulnerability to manipulate privilege assignments incorrectly, potentially gaining unauthorized privileges within the affected system. The impact is rated medium severity with limited confidentiality, integrity, and availability impact. There is no indication of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently available, users should monitor official NousResearch communications for updates. Until a fix is released, consider restricting network access to the hermes-agent service and applying principle of least privilege to limit potential impact.