PT-2026-50518 · Unknown · Hermes-Agent

Hinotoi-Agent · CVE-2026-53869 · Published 2026-06-17 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Hermes Agent versions prior to 0.16.0

Description A DNS rebinding issue in WebSocket endpoints allows remote attackers to bypass Host and Origin validation. This occurs because FastAPI HTTP middleware does not execute for WebSocket upgrade requests on the ' /api/pty', '/api/ws', '/api/pub', and '/api/events' endpoints. DNS rebinding is a technique where a malicious website tricks a browser into sending requests to a local or internal server by manipulating DNS records. This flaw enables attackers to inject malicious commands or read terminal output.

Recommendations Update to version 0.16.0 or later.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2026-53869

GHSA-4PQM-J46F-795X

PYSEC-2026-2510

Affected Products

Hermes-Agent

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53869.json · Exploit
• https://github.com/NousResearch/hermes-agent/commit/d9ec90585cf7616b5972e44cf8d92bb569fc3feb · Patch
• https://osv.dev/vulnerability/CVE-2026-53869 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2510 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-53869 · Security Note
• https://osv.dev/vulnerability/GHSA-4pqm-j46f-795x · Vendor Advisory
• https://github.com/NousResearch/hermes-agent · Note
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5 · Note
• https://github.com/NousResearch/hermes-agent/pull/30221 · Note
• https://github.com/NousResearch/hermes-agent/pull/31685 · Note
• https://vulncheck.com/advisories/hermes-agent-dns-rebinding-bypass-via-websocket-endpoints · Note
• https://pypi.org/project/hermes-agent · Note
• https://github.com/advisories/GHSA-4pqm-j46f-795x · Note
• https://twitter.com/CVEnew/status/2067350999291805988 · Twitter Post
• https://t.me/cveNotify/170592 · Telegram Post