Hermes-Agent (0.18.0) - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/products/hermes-agent-0.18.0/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 03 Sep 2026 13:21:43 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgAuthorization Bypass in NousResearch hermes-agenthttps://feed.craftedsignal.io/briefs/2026-09-hermes-agent-auth-bypass/Thu, 03 Sep 2026 13:21:43 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-hermes-agent-auth-bypass/An authorization bypass vulnerability in the _sess_nowait function of NousResearch hermes-agent version 0.18.0 allows remote attackers to gain unauthorized access by manipulating the session_id argument.NousResearch hermes-agent version 0.18.0 contains a security flaw in the session management component, specifically within the _sess_nowait function located in s71.py. The vulnerability arises from improper validation of the session_id argument, which can be manipulated by a remote attacker to bypass authorization mechanisms. This vulnerability, tracked as CVE-2026-85105, enables unauthenticated actors to potentially hijack or interact with active sessions without valid credentials. The vendor has not responded to disclosure attempts, and no security updates are currently available to address this specific flaw. Organizations utilizing this version of hermes-agent in cloud or network-integrated environments should restrict access to the affected component to prevent unauthorized exploitation.

Impact

Successful exploitation of this vulnerability leads to a complete authorization bypass, allowing attackers to perform actions as an authenticated user or administrative session. This poses a significant risk to data integrity and confidentiality for deployments relying on hermes-agent for session management. As the service is designed for remote interaction, the potential for widespread exploitation across internet-exposed instances is high if the affected endpoint is reachable.

Recommendation

  • Perform an inventory of all systems currently running NousResearch hermes-agent version 0.18.0.
  • Implement strict network-level access controls (ACLs) or VPN requirements to prevent unauthorized remote reachability to the vulnerable session management endpoints.
  • Monitor logs for unusual session activity or repeated attempts to access endpoints with manipulated session identifiers.
  • If a patch or update is released, prioritize its deployment immediately due to the high severity of the authorization bypass.
]]>highadvisory