CVE-2026-82021

Executive Summary

CVE-2026-82021 is a critical supply chain vulnerability (CVSS 8.3) in Hermes Agent versions 0.18.2 and earlier, arising from the agent's bundled MCP (Model Context Protocol) catalog referencing third-party upstream repositories via mutable branches rather than pinned commit SHAs. A remote attacker who compromises any such upstream repository can inject malicious code that propagates automatically to every host installing the affected catalog entry, with no further operator interaction required post-installation. The vulnerability is currently unpatched, no vendor advisory exists, and no public proof-of-concept has been disclosed; however, the attack mechanism is well understood at the vulnerability-class level, making exploitation highly probable once a target upstream repository is identified.

Technical Analysis

The vulnerability is classified under CWE-494 (Download of Code Without Integrity Check), which precisely describes the flaw mechanism: Hermes Agent downloads and executes code from third-party repositories without verifying the integrity of that code via a pinned commit SHA or equivalent cryptographic signature.

The NVD description specifies two key technical facts:

1. Mutable branch references: The bundled MCP catalog within Hermes Agent references third-party upstream repositories using mutable branch names (e.g., main, master, develop) rather than immutable commit SHAs. This means the exact code content fetched at install time is not deterministic — it reflects whatever the branch currently points to at the moment of retrieval.

2. Supply chain propagation: An attacker who compromises the upstream repository (via stolen credentials, compromised maintainer account, malicious pull request merge, or direct write access) can push malicious code to the branch referenced by Hermes Agent's catalog. Because there is no integrity check or pinned SHA reference, the next time any Hermes Agent instance installs or updates the catalog entry, it will fetch and execute the attacker-controlled code.

The attack surface is broad by design: MCP catalogs are intended to be distributed and installed across many hosts. The agent acts as a trust broker — it fetches catalog entries and executes associated code with the privileges of the Hermes Agent process. The NVD description notes that "no further action is required by the operator" once the malicious code has been pushed upstream, meaning the propagation is silent and automatic.

The CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) provides additional insight into the exploitation constraints:

• Attack Vector: Network (AV:N) — The attack is conducted remotely by pushing code to a network-accessible repository.
• Attack Complexity: High (AC:H) — The attacker must first successfully compromise a third-party upstream repository, which requires a separate initial foothold or credential compromise.
• Privileges Required: None (PR:N) — No privileges on the target Hermes Agent host are needed.
• User Interaction: Required (UI:R) — A user must perform an action that triggers the catalog install or update (e.g., running an install command or restarting the agent with a catalog refresh).
• Scope: Changed (S:C) — The compromise of the upstream repository (one security authority) impacts the downstream hosts (a different security authority).
• CIA Impact: High/High/High — Full confidentiality, integrity, and availability compromise of affected hosts.

Exploitation Scenarios

No public PoC is available; the attack chain is inferred from the vulnerability class and the NVD description. The scenario proceeds as follows:

Step 1 — Reconnaissance and Target Identification The attacker identifies a third-party upstream repository that is referenced by Hermes Agent's bundled MCP catalog via a mutable branch. This reconnaissance may involve inspecting publicly available Hermes Agent catalog manifests, examining package registries, or analyzing the agent's configuration files. The attacker looks for repositories with weak security postures: minimal branch protection, no mandatory code review, or maintainers with weak authentication.

Step 2 — Triggering the Flaw Class The attacker compromises the upstream repository through one of several means: phishing the maintainer for credentials, exploiting a separate vulnerability in the repository's CI/CD pipeline, or leveraging an exposed administrative interface. Once write access is obtained, the attacker pushes malicious code to the mutable branch that Hermes Agent references. No interaction with vulnerable hosts is needed at this stage — the weaponization occurs entirely upstream.

Step 3 — Payload Delivery and Execution When any operator installs or updates the Heres Agent MCP catalog entry (the required user interaction per the CVSS vector), the agent fetches the code from the compromised branch without performing an integrity check. The malicious code executes with the privileges of the Hermes Agent process, which in enterprise deployments is commonly a service account with broad system access.

Step 4 — Post-Exploitation Impact The attacker gains arbitrary code execution on every host where the affected catalog entry has been installed and refreshed. Potential impacts include credential theft from the agent's credential store, lateral movement across the enterprise network, deployment of persistent backdoors, data exfiltration of any data the agent processes, and further supply chain propagation if the compromised agent's outputs are consumed by downstream tooling.

Proof of Concept Intelligence

No public proof-of-concept, exploit code, or Nuclei template currently exists for CVE-2026-82021, per the intelligence data. However, exploitation remains highly plausible for the following reasons:

1. Mechanism is well-understood: The vulnerability class (CWE-494 — download of code without integrity check) is a well-documented supply chain attack vector. The general exploitation pattern — compromise a dependency repository, inject malicious code, and let downstream consumers fetch it — has been proven in numerous real-world incidents (e.g., the 2021 ua-parser-js, coa, and rc npm package compromises, and the 2024 XZ Utils backdoor).

2. Mutable branch references are trivially exploitable: Once upstream repository access is obtained, no complex exploit development is required. The attacker pushes code to a branch name that is already trusted by the catalog. There is no memory corruption, no parsing bug, and no technical sophistication required in the payload development.

3. No integrity verification means no bypass needed: The absence of SHA pinning means the attacker does not need to defeat any security control — the control simply does not exist.

Defenders should monitor the following resources for future PoC disclosure:

• GitHub Advisory Database and NVD for updates to CVE-2026-82021.
• Hermes Agent project release notes and commit history for any silent fix or branch-pinning changes.
• Exploit-db and Packet Storm for public PoC submission.
• Security researcher Twitter/X and Mastodon feeds that focus on supply chain vulnerabilities, particularly those covering MCP (Model Context Protocol) tooling.
• OSV.dev for package-level vulnerability tracking.
• Public repositories listing Hermes Agent MCP catalog entries — if an upstream repository referenced by the catalog disappears, changes ownership, or shows unusual commit activity, it may be a sign of active exploitation.

Impact Assessment

Business Impact: This vulnerability represents a critical supply chain risk. Because Hermes Agent is deployed as an automation and orchestration tool, compromise of the agent process grants attackers the same level of access as the agent's service account. In many enterprise environments, this account has broad filesystem access, network egress privileges, and potentially access to secrets and credentials managed by the agent. The CVSS score of 8.3 reflects High confidentiality, integrity, and availability impact with a Changed scope, meaning the compromise of the upstream repository (one trust boundary) leads to full compromise of all downstream hosts (a different trust boundary).

Affected Systems: All hosts running Hermes Agent versions 0.18.2 and earlier where the bundled MCP catalog is actively used. The affected version range is < 0.19.0 — however, since no vendor patch has been issued and 0.19.0's status as a proper fix is unverified, organizations should treat all Hermes Agent installations as potentially vulnerable.

Blast Radius: The blast radius is multiplicative. A single compromised upstream repository can compromise every Hermes Agent deployment that references the affected catalog entry. In large organizations, this could mean hundreds or thousands of hosts becoming compromised through a single upstream repository takeover. The supply chain nature of the vulnerability also means that the malicious code could be propagated further if compromised agents interact with or deploy code to other systems.

CVSS Subscore Analysis: The High AC:H indicates that exploitation requires a significant precondition (successful upstream compromise), which may reduce the practical exploitability in the short term. However, once that precondition is met, exploitation is trivial and requires no additional skill.

Detection Guidance

Sigma Rule

title: Potential Hermes Agent MCP Catalog Supply Chain Compromise
id: 0b4f9d2a-3e5c-4a1b-9f8e-2d6c7a3b1e50
status: experimental
description: Detects Hermes Agent fetching MCP catalog entries from upstream repositories via mutable branches (potential CWE-494 exploitation)
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-82021
author: Valters IT Security Research
date: 2026/01/01
tags:
    - attack.supply_chain
    - attack.t1195.001
    - cve.2026.82021
logsource:
    category: process_creation
    product: linux
detection:
    selection_hermes:
        Image|endswith:
            - '/hermes'
            - '/hermes-agent'
        CommandLine|contains:
            - 'catalog'
            - 'mcp'
    selection_git_branch:
        CommandLine|contains|all:
            - 'clone'
            - '--branch'
    selection_mutable_branch:
        CommandLine|contains:
            - 'refs/heads/main'
            - 'refs/heads/master'
            - 'refs/heads/develop'
    condition: selection_hermes and selection_git_branch and selection_mutable_branch
falsepositives:
    - Legitimate development operations where Hermes Agent clones its own catalogs
level: high

YARA Rule

rule HermesAgent_SupplyChain_NoSHA_Pin
{
    meta:
        author = "Valters IT Security Research"
        description = "Detects Hermes Agent catalog files referencing mutable branches instead of pinned commit SHAs"
        cve = "CVE-2026-82021"
        date = "2026-01-01"
        severity = "high"
    strings:
        $branch_ref = /(refs\/heads\/|branch["' ]*[:=]["' ]*)(main|master|develop|dev|release)/ nocase
        $catalog_ext = ".json"
        $hermes_marker = "hermes"
        $mcp_marker = "mcp" nocase
        $sha_pattern = /[0-9a-f]{40}/ // Valid SHA-1 commit hash
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x7B0D or uint16(0) == 0x0A7B // JSON file signatures
        and any of ($branch_ref)
        and any of ($hermes_marker)
        and any of ($mcp_marker)
        and #sha_pattern == 0 // No pinned SHA present
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82021 - Hermes Agent MCP Catalog Fetching Mutable Branch";
    flow:established,to_server;
    content:"GET"; http_method;
    content:"/catalog"; http_uri;
    content:"branch"; http_uri;
    pcre:"/(main|master|develop|dev|release)/Ui";
    classtype:attempted-admin;
    sid:8202101; rev:1;
    metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE-2026-82021;
)

Elastic Detection

sequence by process.entity_id with maxspan=30s
  [process where process.name : ("hermes", "hermes-agent") and
   process.args : "catalog*"]
  [network where process.name : ("hermes", "hermes-agent") and
   destination.port == 443 and
   network.protocol : "https" and
   url.path : "*catalog*" and
   url.query : "*branch*"]

Splunk SPL Query

index=process sourcetype=ProcessRollup2
| search (Image="*hermes*" OR CommandLine="*hermes-agent*")
    AND (CommandLine="*catalog*" OR CommandLine="*mcp*")
    AND (CommandLine="*--branch*" OR CommandLine="*refs/heads/*")
    AND (CommandLine="*main" OR CommandLine="*master" OR CommandLine="*develop")
| stats count by host, Image, CommandLine, _time
| sort -_time

Wazuh OSSEC Rule

<group name="hermes_agent,">
    <rule id="820211" level="12">
        <decoded_as>json</decoded_as>
        <field name="image">\.*hermes.*</field>
        <description>Hermes Agent process executed with catalog update command</description>
        <group>supply_chain,</group>
    </rule>

    <rule id="820212" level="15">
        <if_sid>820211</if_sid>
        <field name="command">\.*branch.*</field>
        <description>Potential CVE-2026-82021 exploitation - Hermes Agent fetching mutable branch from MCP catalog</description>
        <group>supply_chain,</group>
    </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED) — no patch evidence from any tracked source. No vendor advisory, no fix commit, and no upgrade guidance has been published. Although the NVD description mentions Hermes Agent 0.19.0, there is no confirmation from the vendor that this version resolves the vulnerability.

1. Immediate Mitigations (Until Patch Available)

• Restrict network egress: Block Hermes Agent processes from reaching outbound network connections to git hosting services (e.g., github.com, gitlab.com, bitbucket.org) unless explicitly required for legitimate catalog updates.
• Disable automatic catalog updates: If Hermes Agent supports configuration to disable auto-update or auto-refresh of MCP catalog entries, enable it immediately. This prevents the agent from fetching new code from potentially compromised branches.
• Pin catalogs manually: If catalog configuration files are locally accessible, manually replace all mutable branch references (e.g., refs/heads/main) with pinned commit SHAs for known-good versions of each upstream repository. This directly addresses the root cause (CWE-494).
• Audit existing catalog state: Review all currently installed catalog entries on all Hermes Agent hosts. Check the fetched code against the upstream repository's known-good commit for signs of tampering.
• Monitor upstream repositories: Identify all third-party repositories referenced by the MCP catalog and monitor them for unexpected commits, branch force-pushes, or maintainer account anomalies.

2. Patch/Upgrade Steps

• No official patch is currently available. Monitor the Hermes Agent project's release announcements and security advisories for a patched version that either (a) pins all catalog references to immutable commit SHAs, or (b) introduces cryptographic signature verification for catalog entries.
• Do NOT assume that upgrading to 0.19.0 is safe — verify with the vendor that the mutable branch issue is specifically addressed before deploying.
• If a patched version is released, validate the patch in a staging environment first, then deploy across the enterprise following standard change management procedures.

3. Long-Term Hardening

• Implement Software Bill of Materials (SBOM): Maintain a complete inventory of all third-party dependencies and their exact commit SHAs for all deployed agents.
• Adopt CI/CD integrity verification: Implement a policy that all external code fetched during deployment must be pinned to immutable commit SHAs and verified against cryptographic hashes.
• Network segmentation: Place Hermes Agent hosts on a separate network segment with strict egress controls, limiting the agent's ability to reach arbitrary external hosts.
• Harden upstream repository access: For any repositories the organization controls that are referenced by MCP catalogs, enable branch protection, mandatory code review, and hardware-based MFA for maintainers.
• Establish a vulnerability watch list: Subscribe to security advisories for Hermes Agent and all upstream repositories referenced by its catalog.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82021 — Official CVE record with CVSS scoring and description.
2. CWE-494 Reference: https://cwe.mitre.org/data/definitions/494.html — Download of Code Without Integrity Check, the underlying weakness class.
3. MITRE ATT&CK T1195.001: https://attack.mitre.org/techniques/T1195/001/ — Supply Chain Compromise: Compromise Software Dependencies and Development Tools.
4. NVD CVSS Calculator: https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H — Annotated CVSS vector for this vulnerability.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: None documented at the time of this report. No known threat actor campaigns have been attributed to CVE-2026-82021, and there is no evidence of exploitation in the wild. However, the vulnerability pattern closely parallels historical supply chain incidents (e.g., the 2021 npm package compromises and the 2024 XZ Utils backdoor), where code was injected at the dependency level and propagated to downstream consumers. Security teams should treat this vulnerability as a credible near-term threat given how straightforward exploitation is once the upstream precondition is met.