| Название | NousResearch hermes-agent 0.16.0 Improper Access Control (CWE-284) |
|---|
| Описание | # Technical Details
An Improper Access Control vulnerability exists in the tool-policy filtering of hermes-agent. When a session is configured with `disabled_toolsets=['memory']`, the `model_tools.get_tool_definitions()` function correctly removes the built-in `memory` tool. However, a second-stage injection in `agent/agent_init.py` later appends external memory-provider tool schemas (such as `fact_store` and `fact_feedback` from the bundled `holographic` memory provider) into the final model-visible tool list. This late injection only checks `enabled_toolsets` and does not consult `disabled_toolsets`, allowing persistent memory writes in sessions that explicitly intended to disable memory tooling.
# Vulnerable Code
File: agent/agent_init.py (lines 1168-1184)
Method: AIAgent.__init__() / inject_memory_provider_tools
Why: The late injection path appends memory-provider tool schemas based only on `enabled_toolsets`, bypassing `disabled_toolsets`.
File: plugins/memory/holographic/__init__.py (lines 38-89)
Method: HolographicMemoryProvider.__init__() / get_all_tool_schemas()
Why: The provider defines callable `fact_store` and `fact_feedback` schemas that become visible after the late append.
File: plugins/memory/holographic/__init__.py (lines 228-235)
Method: handle_tool_call()
Why: The provider dispatches `fact_store` and `fact_feedback` as real tool actions, not inert metadata.
# Reproduction
1. Checkout nousresearch/hermes-agent and set up a session with `disabled_toolsets=['memory']`.
2. Initialize an AIAgent with the holographic memory provider configured.
3. Inspect `agent.valid_tool_names` to confirm `fact_store` and `fact_feedback` are present.
4. Execute `fact_store` through Hermes' standard tool executor.
5. Independently verify the SQLite write in the provider's `facts` table.
6. Confirm the control case (no provider configured) shows no fact tools.
# Impact
- Tool-policy bypass affecting deployments relying on `disabled_toolsets` to constrain model side effects.
- Model can persist facts, alter feedback scores, and influence future recall behavior in contexts where operators believed memory writes were blocked.
- Persistent SQLite side effects despite explicit memory-policy opt-out. |
|---|
| Источник | ⚠️ https://github.com/NousResearch/hermes-agent/issues/48181 |
|---|
| Пользователь | ChenMarry (UID 99089) |
|---|
| Представление | 18.06.2026 09:30 (2 месяцы назад) |
|---|
| Модерация | 05.08.2026 21:20 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 386377 [NousResearch hermes-agent до 0.16.0 Memory Toolset model_tools.py эскалация привилегий] |
|---|
| Баллы | 20 |
|---|