| Название | NousResearch Hermes Agent 0.16.0 Incorrect Privilege Assignment (CWE-266) |
|---|
| Описание | # Technical Details
A Memory Provider Tool Policy Bypass exists in the `agent/agent_init.py` post-filter injection logic of Hermes Agent.
The application fails to respect `disabled_toolsets=['memory']` when injecting holographic memory provider tool schemas. After `get_tool_definitions()` correctly removes the built-in `memory` tool, a later code path re-appends memory provider tools (`fact_store`, `fact_feedback`) based only on `enabled_toolsets is None or "memory" in enabled_toolsets`, ignoring `disabled_toolsets`. The check at line 1208 evaluates `agent.enabled_toolsets is None` as `True` when `disabled_toolsets=["memory"]` is set (backward-compat default), causing the deny policy to be bypassed and provider tools re-injected into `agent.valid_tool_names`.
# Vulnerable Code
File: agent/agent_init.py
Method: AIAgent.__init__ — post-filter memory provider injection (around line 1153-1184, guard at line 1208)
Why: The guard only checks `enabled_toolsets` and does not check `disabled_toolsets`. When `disabled_toolsets=['memory']` is set, `enabled_toolsets` defaults to `None`, and `agent.enabled_toolsets is None` evaluates to `True`, re-injecting memory provider tools.
# Reproduction
1. Configure Hermes Agent with `memory.provider: holographic` and create a session with `disabled_toolsets=['memory']`.
2. Send a chat interaction that triggers fact storage.
3. Observe that `fact_store` and `fact_feedback` remain visible in `valid_tool_names` and that facts are persisted to the SQLite store.
4. Confirm the control case correctly blocks the built-in `memory` tool but leaves `fact_store` / `fact_feedback` callable.
# Impact
- Defeats the security purpose of `disabled_toolsets=['memory']`, allowing unauthorized persistence of sensitive conversation content.
- Enables unintended mutation of long-term memory state in sessions intended to be memory-free.
- Breaks toolset isolation for gateway, API, cron, CLI, or embedded workflows relying on toolset denial. |
|---|
| Источник | ⚠️ https://github.com/NousResearch/hermes-agent/issues/46171 |
|---|
| Пользователь | Erichen-apple (UID 99087) |
|---|
| Представление | 18.06.2026 08:36 (2 месяцы назад) |
|---|
| Модерация | 05.08.2026 18:17 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 386264 [NousResearch hermes-agent до 0.16.0 disabled_toolsets agent/agent_init.py get_tool_definitions эскалация привилегий] |
|---|
| Баллы | 20 |
|---|