NousResearch hermes-agent up to 0.12.0 resume Endpoint hermes_state.py resolve_session_by_title Title authorization

Summaryinfo

A vulnerability classified as critical has been found in NousResearch hermes-agent up to 0.12.0. This impacts the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Performing a manipulation of the argument Title results in authorization. This vulnerability is identified as CVE-2026-11461. The attack can be initiated remotely. Additionally, an exploit exists. The vendor was contacted early about this disclosure but did not respond in any way.

Detailsinfo

A vulnerability classified as critical has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. The manipulation of the argument title with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-639. The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data. This is going to have an impact on confidentiality, integrity, and availability.

The advisory is shared at gist.github.com. This vulnerability is uniquely identified as CVE-2026-11461. The exploitability is told to be easy. It is possible to initiate the attack remotely. Technical details and a public exploit are known.

The exploit is shared for download at gist.github.com. It is declared as proof-of-concept. The vendor was contacted early about this disclosure but did not respond in any way.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2026-34992). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• NousResearch

Name

• hermes-agent

Version

• 0.1
• 0.2
• 0.3
• 0.4
• 0.5
• 0.6
• 0.7
• 0.8
• 0.9
• 0.10
• 0.11
• 0.12.0

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #829402: NousResearch hermes-agent <= v0.12.0 Authorization Bypass Through User-Controlled Key (CWE-639) (by Eric-b)

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion