Description

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-08-28T20:20:14.323Z",
  "pubdate": "2026-08-28T20:20:14.323Z",
  "executiveSummary": "Hermes Agent versions 0.16.0 through 0.17.0 are susceptible to an improper path restriction vulnerability, classified as a security flaw in path validation logic.\nThe vulnerability allows an attacker capable of influencing ingested message content to perform unauthorized file system operations, specifically overwriting the sensitive credential store located at auth.json.\nBy bypassing established sensitive-path guards, an attacker can manipulate the agent's file-write tooling to overwrite critical authentication files without triggering existing security controls.\nThe impact includes potential credential tampering, unauthorized access to the agent's identity, and complete compromise of the affected node's security posture.\nThis vulnerability requires an attacker to successfully inject malicious content into the message ingestion pipeline of the Hermes Agent, which then interprets the payload to execute arbitrary file write operations.\nRisk is considered significant as it enables the compromise of persistent authentication data used by the agent for downstream service interactions.",
  "technicalDetails": "The root cause of this vulnerability lies in an inadequate path validation mechanism within the Hermes Agent's message ingestion and file-write tooling. The system implemented a filter to protect specific sensitive files; however, the regex or logic governing the exclusion of the auth.json file was flawed or bypassed through payload normalization techniques.\nIn Hermes Agent 0.16.0, the ingestion engine processes incoming messages and delegates file-write tasks based on content instructions. The application logic fails to properly canonicalize or validate the target destination path against a strict allowlist. Instead, it relies on a blocklist mechanism that specifically identifies paths to protect. Because the security guard for auth.json was either incorrectly configured or bypassed through relative path traversal or symbolic link manipulation, the agent's internal write function accepts the malicious payload as a legitimate request.\nThe attack flow proceeds as follows: First, the attacker crafts a malicious message payload containing an instruction for the file-write component. This instruction is designed to specify auth.json as the target file path. Because the guard mechanism fails to evaluate this path as sensitive, the file-write component proceeds without raising an exception or stopping the process. The agent then writes attacker-controlled content—such as new credential data or an invalid token—into the auth.json file.\nThis overwrite effectively forces the agent to use the attacker-provided credentials, leading to credential tampering. In a post-exploitation scenario, an attacker can substitute the existing legitimate credentials with those they control, granting them unauthorized access to any resources or systems the Hermes Agent is authorized to interact with. Because the agent executes this write operation with its own system privileges, the operation succeeds, bypassing the need for separate authorization if the attacker can successfully reach the message ingestion interface.\nThe vulnerability affects all instances of Hermes Agent version 0.16.0 prior to 0.17.0. No specific network exposure is required other than reachability to the ingestion point, and the attack does not require pre-existing authentication if the ingestion point itself is public-facing or accessible to unauthenticated users within the environment."
}