Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-7112: NousResearch hermes-agent 0.8.0: Remote Authentication Bypass

CVE-2026-7112 · published 6 months ago

Summary

A security issue in NousResearch hermes-agent 0.8.0 allows an attacker to bypass authentication remotely. This could potentially allow unauthorized access to the system. NousResearch has not yet addressed this issue, so update to a fixed version or take other precautions to protect your system.

Original advisory text

A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api_server.py of the component API_SERVER_KEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

References

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

2.9 Low

Exploitation

<1% chance of attack within 30 days

Type

CWE-287Improper Authentication

Timeline

Published27 Apr 2026

Updated4 Nov 2026

First seen27 Apr 2026

Sources

CVE-2026-7112 · NVD

Track software like this

Free during beta