What happened
Verified on the merged pull request (fetched): toolsets_for_source recovered the per-route toolsets grant by splitting chat_id on ':', allowing a route named 'build:external' to inherit 'build' toolsets; reproduced on main through the real aiohttp handler with a signed request. Reported in GHSA-2fmg-cjqm-hhrj.
Why it matters
Webhook-driven agent invocation is a standard integration pattern for agent gateways; this parse inconsistency lets an attacker holding one weak webhook credential reach another route's terminal/file tools — arbitrary command/file access on the agent host.
Attack vector
The webhook gateway builds session chat_id as 'webhook:{route_name}:{delivery_id}' and re-derives the authorizing route by splitting on ':', while authentication uses the exact URL segment; delivery_id is caller-supplied (X-GitHub-Delivery, svix-id, X-Request-ID), so a crafted route name like 'build:external' resolves to route 'build' and inherits its privileged toolsets.
Affected systems
Nous Research Hermes Agent — webhook platform gateway (fixed in PR #115285, GHSA-2fmg-cjqm-hhrj)
Mitigation
Apply the fix merged in PR #115285 (key toolsets_for_source on source.user_id stamped from the authenticated URL segment instead of splitting chat_id); update Hermes Agent.