PT-2026-50518 · Nousresearch · Hermes-Agent

Published 2026-06-17 · Updated 2026-06-17 · CVE-2026-53869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Hermes Agent versions prior to 0.16.0

Description A DNS rebinding issue in WebSocket endpoints allows remote attackers to bypass Host and Origin validation. This occurs because FastAPI HTTP middleware does not execute for WebSocket upgrade requests on the ' /api/pty', '/api/ws', '/api/pub', and '/api/events' endpoints. DNS rebinding is a technique where a malicious website tricks a browser into sending requests to a local or internal server by manipulating DNS records. This flaw enables attackers to inject malicious commands or read terminal output.

Recommendations Update to version 0.16.0 or later.

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-53869

Affected Products

Hermes-Agent

References · 6

• https://github.com/NousResearch/hermes-agent/commit/d9ec90585cf7616b5972e44cf8d92bb569fc3feb · Patch
• https://github.com/NousResearch/hermes-agent/pull/31685 · Note
• https://github.com/NousResearch/hermes-agent/pull/30221 · Note
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5 · Note
• https://vulncheck.com/advisories/hermes-agent-dns-rebinding-bypass-via-websocket-endpoints · Note
• https://twitter.com/CVEnew/status/2067350999291805988 · Twitter Post