PT-2026-35395 · Nousresearch · Hermes-Agent

Yu-Bao · Published 2026-04-27 · Updated 2026-05-17 · CVE-2026-7113

Positive Technologies (AI Summary)

CVSS v3.1

5.6

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Name of the Vulnerable Software and Affected Versions NousResearch hermes-agent version 0.8.0

Description A flaw in the Webhooks Endpoint component, specifically within the gateway/platforms/webhook.py file, allows for missing authentication. This occurs through the manipulation of the INSECURE NO AUTH argument. The issue can be exploited remotely, although it is characterized by high complexity and difficult exploitation.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Missing Authentication

Weakness Enumeration

CWE-287

CWE-306

Related Identifiers

CVE-2026-7113

Affected Products

Hermes-Agent

References · 12

• 🔥 https://github.com/NousResearch/hermes-agent/issues/6440 · Exploit
• https://github.com/NousResearch/hermes-agent/pull/6445 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-7113 · Security Note
• https://twitter.com/VulmonFeeds/status/2048778681309422052 · Twitter Post
• https://github.com/NousResearch/hermes-agent · Note
• https://twitter.com/CVEnew/status/2048852212135170450 · Twitter Post
• https://reddit.com/r/better_claw/comments/1tfgryr/openclaw_vs_hermes_what_is_the_deal · Reddit Post
• https://vuldb.com/vuln/359713 · Note
• https://t.me/CVEtracker/51925 · Telegram Post
• https://vuldb.com/submit/800802 · Note
• https://vuldb.com/vuln/359713/cti · Note
• https://t.me/cveNotify/161047 · Telegram Post