External risk intelligence

Hermes Agent MCP Catalog Supply Chain Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-82021

This is a supply chain vulnerability affecting a build-time or installation-time process where an agent fetches components from an upstream repository. It is not an internet-facing service, gateway, or edge endpoint reachable by remote attackers in normal deployment, but rather a dependency management issue during the software installation or update phase.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A supply chain vulnerability in the Hermes Agent's bundled catalog allows remote code execution if a third-party upstream repository is compromised and referenced via a mutable branch. This could lead to malicious code propagation to all hosts installing the affected catalog entry without further operator action.

Malicious code can spread if a dependency repository is compromised.
Understand how supply chain risks impact our software dependencies.
Confirm if this dependency is used in our environment.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a third-party upstream repository to inject malicious code. If this compromised repository is referenced by a mutable branch in the affected software's catalog, any host installing that catalog entry will automatically download and execute the malicious code, potentially leading to arbitrary code execution.

Compromised upstream repository required.
Vulnerable catalog entry installed.
Arbitrary code execution risk.

Live Threat

Current exploitation, exposure, and threat context

A supply chain vulnerability in the bundled MCP catalog could allow a remote attacker to execute arbitrary code. This could occur if a third-party upstream repository referenced by a mutable branch is compromised. The attacker could then propagate malicious code to any host installing the affected catalog entry without further operator action.

System data and service behavior could be affected.
Malicious code propagates through compromised upstream repository.
Remote code execution on affected hosts.

Operational Fix

Recommended remediation, mitigation, and detection steps

This supply chain vulnerability affects how the Hermes Agent fetches its MCP catalog. Responsibility likely falls to the platform or infrastructure teams managing the agent's deployment and dependencies, in coordination with security teams to assess exposure. The first step is to identify all instances where the affected catalog is used, confirm its reachability, and then engage the accountable owner to plan remediation.

Platform/Infrastructure teams own remediation.
Verify catalog usage and reachability.
Plan vendor coordination and updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Hermes Agent?

Hermes Agent is a software component designed to interact with Model Context Protocol (MCP) catalogs. It simplifies how applications pull external tools and data into a unified workflow. By bundling these catalogs, the agent helps users quickly integrate third-party services into their environments, though this mechanism relies on fetching remote code during installation or updates.

What does CVE-2026-82021 mean in plain English?

This is a supply chain vulnerability, specifically classified as CWE-494 (Download of Code Without Integrity Check). The software references external code libraries using 'mutable branches'—like a 'latest' tag—which can change at any time. If an attacker gains control of that third-party repository, they can swap legitimate code for malicious code, which your system then automatically downloads and executes as if it were authentic.

How does an attacker trigger this vulnerability?

An attacker must first successfully compromise the specific third-party repository that the Hermes Agent fetches. The vulnerability is not triggered by direct interaction with your running agent; instead, it occurs when the agent performs an update or installation that pulls the tainted code from the now-compromised source. It does not trigger if the software only relies on fixed, cryptographically pinned version identifiers rather than mutable branches.

Is my system at risk according to Halo Surface Signal?

Halo Surface Signal indicates that this is very unlikely to be a direct internet-facing threat. Because the vulnerability exists in a build-time or dependency-management process rather than a publicly exposed network service or gateway, it generally does not provide a direct path for remote attackers to probe your infrastructure from the internet.

What should I do if I use Hermes Agent?

First, conduct an inventory to determine which systems currently run Hermes Agent versions 0.18.2 or older. Once identified, work with your infrastructure team to pause automatic updates that might pull from unverified mutable branches. Prioritize upgrading to a non-vulnerable version (0.19.0 or later) that properly secures its dependency references to prevent the automatic execution of unauthorized code.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.