PT-2026-2310 · Unknown+1 · Inveniordm+1

Thunze · Published 2026-01-12 · Updated 2026-03-08 · CVE-2026-22798

Positive Technologies (AI Summary)

CVSS v3.1

5.9

Medium

Base vector

AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions hermes versions 0.8.1 through 0.9.0

Description hermes, a software publication automation workflow, exhibits a flaw where subcommands accept arbitrary options through the -O argument. Providing sensitive data, such as API tokens (e.g., via hermes deposit -O invenio rdm.auth token SECRET), results in the data being written to log files in plain text. This exposes the information to anyone with access to these log files. The -O argument is used to pass options to subcommands. The invenio rdm.auth token variable is an example of a sensitive data element.

Recommendations Upgrade to version 0.9.1 or later.

Exploit

Fix

Insertion into Log File

Weakness Enumeration

CWE-532

Related Identifiers

CVE-2026-22798

GHSA-JM5J-JFRM-HM23

Affected Products

Hermes

Inveniordm

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/22xxx/CVE-2026-22798.json · Exploit
• https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23 · Vendor Advisory
• https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514 · Patch
• https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1 · Patch
• https://osv.dev/vulnerability/CVE-2026-22798 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-22798 · Security Note
• https://osv.dev/vulnerability/GHSA-jm5j-jfrm-hm23 · Vendor Advisory
• https://github.com/softwarepub/hermes · Note
• https://twitter.com/VulmonFeeds/status/2010916918874505708 · Twitter Post
• https://twitter.com/_cvereports/status/2011439592465973588 · Twitter Post
• https://t.me/cveNotify/154648 · Telegram Post
• https://twitter.com/CVEnew/status/2010843497318801776 · Twitter Post
• https://twitter.com/dailycve/status/2030484942787088410 · Twitter Post