CVE-2026-82020 in Hermes Agent
Summary
by MITRE • 08/28/2026
Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/28/2026
The vulnerability identified in Hermes Agent versions prior to 0.17.0 represents a critical failure in input validation and path traversal prevention mechanisms. This flaw is classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, which occurs when software does not properly neutralize special elements within file paths that can cause the path to resolve outside of the intended directory. In this specific instance, the Hermes Agent utilizes internal tooling designed for writing files based on content from ingested messages. The security architecture includes sensitive-path guards intended to restrict write operations to a predefined set of safe locations or filenames. However, these guards failed to adequately filter or validate inputs that could manipulate file paths, specifically allowing access to the auth.json credential store which was explicitly excluded from normal write permissions but remained accessible through bypass techniques.
The technical mechanism behind this vulnerability relies on the agent's inability to correctly parse and sanitize user-controlled input before passing it to underlying file system operations. Attackers who have the ability to influence ingested message content can craft payloads that exploit weaknesses in path normalization or string handling logic within the Hermes Agent. By manipulating these inputs, an adversary can bypass the sensitive-path guards that were designed to prevent writes to critical configuration files like auth.json. This lack of strict enforcement allows the file-write tooling to interpret maliciously crafted paths as valid targets, effectively tricking the application into writing data to a location it should have been prohibited from accessing. The absence of robust canonicalization checks or allow-listing mechanisms for target filenames leaves the integrity of the credential store vulnerable to external manipulation.
The operational impact of this vulnerability is severe due to its direct effect on authentication and authorization systems. Since auth.json typically contains sensitive credentials, API keys, or session tokens required for the Hermes Agent to function securely, overwriting this file can lead to complete compromise of the agent's identity. An attacker who successfully exploits this flaw can replace valid credentials with their own malicious ones, thereby gaining unauthorized access to resources protected by these credentials. This could result in data exfiltration, privilege escalation within connected systems, or the establishment of a persistent backdoor for future attacks. The ability to tamper with credential stores undermines the fundamental trust model of the application and can have cascading effects on any downstream services that rely on the Hermes Agent for secure communication.
From a threat intelligence perspective, this vulnerability aligns with MITRE ATT&CK technique T1552: Unsecured Credentials, specifically sub-technique T1552.004 which involves accessing credential files directly from local systems. The exploitation path also reflects aspects of CWE-732: Incorrect Permission Assignment for Critical Resource, as the file permissions or access controls were not correctly configured to prevent unauthorized writes despite logical restrictions in the application code. To mitigate this risk, organizations running Hermes Agent versions prior to 0.17.0 must upgrade immediately to version 0.17.0 where these path restriction mechanisms have been hardened. In addition to upgrading, administrators should implement strict file integrity monitoring on credential stores and enforce principle of least privilege by ensuring that the user account executing the Hermes Agent has minimal write permissions restricted only to necessary operational directories. Regular auditing of ingested message content and implementing allow-listing for all file paths used in internal tooling will further reduce the attack surface against similar path traversal vulnerabilities.