DNS Rebinding Vulnerability in Hermes Agent by Nous Research
CVE-2026-53869

8.7HIGH

Key Information:

Vendor

Nousresearch

Status
Hermes-agent
Vendor
CVE Published:
17 June 2026

What is CVE-2026-53869?

Hermes Agent versions prior to 0.16.0 contain a security flaw that permits remote attackers to exploit WebSocket endpoints through DNS rebinding. This weakness allows an attacker to bypass Host and Origin validation due to the FastAPI HTTP middleware not executing for specific WebSocket upgrade requests. As a result, malicious entities can inject commands or access terminal output via the affected endpoints, posing a significant risk to the integrity and confidentiality of the system.

Affected Version(s)

hermes-agent 0 < 0.16.0

hermes-agent 0.16.0

References

https://github.com/NousResearch/hermes-agent/releases/tag...
release-notes
https://github.com/NousResearch/hermes-agent/pull/30221
issue-tracking
https://github.com/NousResearch/hermes-agent/pull/31685
issue-tracking

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Chia Min Jun Lennon
.