This vulnerability affects NousResearch hermes-agent versions up to 0.16.0 and is caused by improper access controls in an unknown functionality within the hermes-agent/model_tools.py file of the Memory Toolset component. The flaw can be exploited remotely without requiring user interaction or elevated privileges. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality, integrity, and availability impacts. Public exploit code exists, but no vendor remediation or patch information is currently available.

The vulnerability allows remote attackers to bypass access controls, potentially leading to unauthorized access or manipulation of the affected component. The impact is limited to confidentiality, integrity, and availability to a low degree. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary workaround is documented, users should monitor vendor communications for updates. Until a patch is available, restrict network exposure of the hermes-agent service where possible.