Authorization Bypass in NousResearch Hermes-Agent Up to 0.12.0
CVE-2026-11461

5.3MEDIUM

Key Information:

Vendor: Nousresearch
Status: Hermes-agent
Vendor: CVE Published:; 7 June 2026

🔔 Create Nousresearch Vulnerability Alert

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-11461?

An authorization bypass vulnerability has been identified in NousResearch's hermes-agent, specifically affecting versions up to 0.12.0. The issue arises within the 'resolve_session_by_title' function of the 'hermes_state.py' file, where manipulation of the 'Title' argument can allow unauthorized access without proper authentication. This vulnerability can be exploited remotely, posing a significant risk as it has already been disclosed publicly. Despite early notification attempts to the vendor, no responses have been received, making it crucial for users to update to the latest version to mitigate potential threats.

Affected Version(s)

hermes-agent 0.1

hermes-agent 0.2

hermes-agent 0.3

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-11461 - Proof of Concept