提交 #862610: NousResearch hermes-agent 0.16.0 Improper Access Control (CWE-284)

# Technical Details
An Improper Access Control vulnerability exists in the tool-policy filtering of hermes-agent. When a session is configured with `disabled_toolsets=['memory']`, the `model_tools.get_tool_definitions()` function correctly removes the built-in `memory` tool. However, a second-stage injection in `agent/agent_init.py` later appends external memory-provider tool schemas (such as `fact_store` and `fact_feedback` from the bundled `holographic` memory provider) into the final model-visible tool list. This late injection only checks `enabled_toolsets` and does not consult `disabled_toolsets`, allowing persistent memory writes in sessions that explicitly intended to disable memory tooling.

# Vulnerable Code
File: agent/agent_init.py (lines 1168-1184)
Method: AIAgent.__init__() / inject_memory_provider_tools
Why: The late injection path appends memory-provider tool schemas based only on `enabled_toolsets`, bypassing `disabled_toolsets`.

File: plugins/memory/holographic/__init__.py (lines 38-89)
Method: HolographicMemoryProvider.__init__() / get_all_tool_schemas()
Why: The provider defines callable `fact_store` and `fact_feedback` schemas that become visible after the late append.

File: plugins/memory/holographic/__init__.py (lines 228-235)
Method: handle_tool_call()
Why: The provider dispatches `fact_store` and `fact_feedback` as real tool actions, not inert metadata.

# Reproduction
1. Checkout nousresearch/hermes-agent and set up a session with `disabled_toolsets=['memory']`.
2. Initialize an AIAgent with the holographic memory provider configured.
3. Inspect `agent.valid_tool_names` to confirm `fact_store` and `fact_feedback` are present.
4. Execute `fact_store` through Hermes' standard tool executor.
5. Independently verify the SQLite write in the provider's `facts` table.
6. Confirm the control case (no provider configured) shows no fact tools.

# Impact
- Tool-policy bypass affecting deployments relying on `disabled_toolsets` to constrain model side effects.
- Model can persist facts, alter feedback scores, and influence future recall behavior in contexts where operators believed memory writes were blocked.
- Persistent SQLite side effects despite explicit memory-policy opt-out.

• 来源: ⚠️ https://github.com/NousResearch/hermes-agent/issues/48181
• 用户: ChenMarry (UID 99089)
• 提交: 2026-06-18 09時30分 (2 月前)
• 管理: 2026-08-05 21時20分 (2 months later)
• 状态: 已接受
• VulDB条目: 386377 [NousResearch hermes-agent 直到 0.16.0 Memory Toolset model_tools.py 权限提升]
• 积分: 20