Improper Path Restriction Vulnerability in Hermes Agent by NousResearch

CVE-2026-82020

What is CVE-2026-82020?

The vulnerability in Hermes Agent versions prior to 0.17.0 allows attackers to manipulate ingested message content to perform credential store overwrites. By circumventing established sensitive-path safeguards that ordinarily prevent access to critical files, including auth.json, an attacker can craft malicious messages to direct the agent's file-writing capabilities. This exploitation facilitates unauthorized access and potential credential tampering, posing significant risks to system integrity.

References