CVE-2026-22798

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-22798", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-01-09T22:50:10.287Z", "datePublished": "2026-01-12T22:00:30.175Z", "dateUpdated": "2026-01-13T19:08:22.846Z"}, "containers": {"cna": {"title": "hermes's raw options logging may disclose secrets passed in via subcommand options argument", "problemTypes": [{"descriptions": [{"cweId": "CWE-532", "lang": "en", "description": "CWE-532: Insertion of Sensitive Information into Log File", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23"}, {"name": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1", "tags": ["x_refsource_MISC"], "url": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1"}, {"name": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514", "tags": ["x_refsource_MISC"], "url": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514"}], "affected": [{"vendor": "softwarepub", "product": "hermes", "versions": [{"version": ">= 0.8.1, < 0.9.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:00:30.175Z"}, "descriptions": [{"lang": "en", "value": "hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1."}], "source": {"advisory": "GHSA-jm5j-jfrm-hm23", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-13T14:14:24.495713Z", "id": "CVE-2026-22798", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T19:08:22.846Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-22798", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-13T14:14:24.495713Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-13T14:14:28.068Z"}}], "cna": {"title": "hermes's raw options logging may disclose secrets passed in via subcommand options argument", "source": {"advisory": "GHSA-jm5j-jfrm-hm23", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.9, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "softwarepub", "product": "hermes", "versions": [{"status": "affected", "version": ">= 0.8.1, < 0.9.1"}]}], "references": [{"url": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23", "name": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1", "name": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514", "name": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-532", "description": "CWE-532: Insertion of Sensitive Information into Log File"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-01-12T22:00:30.175Z"}}}, "cveMetadata": {"cveId": "CVE-2026-22798", "state": "PUBLISHED", "dateUpdated": "2026-01-13T19:08:22.846Z", "dateReserved": "2026-01-09T22:50:10.287Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-01-12T22:00:30.175Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "hermes", "vendor": "softwarepub", "versions": [{"status": "affected", "version": ">= 0.8.1, < 0.9.1"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:software-metadata.pub:hermes:*:*:*:*:*:python:*:*", "matchCriteriaId": "07386E38-99F7-45C8-8749-BC88CB7BE99F", "versionEndExcluding": "0.9.1", "versionStartIncluding": "0.8.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1."}, {"lang": "es", "value": "hermes es una implementaci\u00f3n del flujo de trabajo HERMES para automatizar la publicaci\u00f3n de software con metadatos enriquecidos. Desde la versi\u00f3n 0.8.1 hasta antes de la 0.9.1, los subcomandos de hermes aceptan opciones arbitrarias bajo el argumento -O. Estas se han registrado en formato sin procesar. Si los usuarios proporcionan datos sensibles como tokens de API (p. ej., a trav\u00e9s de hermes deposit -O invenio_rdm.auth_token SECRET), estos se escriben en el archivo de registro en texto plano, haci\u00e9ndolos disponibles para cualquiera que pueda acceder al archivo de registro. Esta vulnerabilidad se corrige en la versi\u00f3n 0.9.1."}], "id": "CVE-2026-22798", "lastModified": "2026-06-17T10:20:26.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.5, "impactScore": 4.0, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.3, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22798", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-13T14:14:24.495713Z", "version": "2.0.3"}}]}, "published": "2026-01-12T22:16:08.780", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/softwarepub/hermes/commit/7f64f102e916c76dc44404b77ab2a80f5a4e59b1"}, {"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/softwarepub/hermes/commit/90cb86acd026e7841f2539ae7a1b284a7f263514"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/softwarepub/hermes/security/advisories/GHSA-jm5j-jfrm-hm23"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-532"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-18T06:56:58.342940+00:00", "value": {"mitigation_remediation": ["Upgrade to hermes version 0.9.1 or later", "Restrict file system permissions so that only authorized users can read the hermes log files", "Avoid passing sensitive credentials through the -O option; use environment variables or secure configuration files instead"], "summary": {"action": "Apply Patch", "impact": "Information disclosure through unencrypted logging of command line options"}, "threat_synthesis": {"affected_systems": "Affected vendor: softwarepub, product: hermes. Versions from 0.8.1 up to before 0.9.1 are vulnerable. The fix was implemented in release 0.9.1. The vulnerability affects all installations that use the command\u2011line interface and write logs to disk. No specific operating system or platform exclusions are noted.", "description_and_impact": "The vulnerability arises when hermes subcommands accept arbitrary options under the -O flag and log them verbatim. If a user supplies sensitive data such as API tokens via this option, that data is written to the standard log file in clear text. Attackers who can read the log therefore obtain credentials that could compromise downstream services. The CWE associated with this issue is Log File Data Leak (CWE\u2011532).", "risk_and_exploitability": "The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests the probability of exploitation in the wild is very low. Because the flaw is discovered via local accessibility to log files, the attack vector is most likely local or remote if an attacker already gains file read access; it is not a remote code execution vector. The vulnerability is not yet listed in the CISA KEV catalog, so no active exploit is documented. Nevertheless, any compromise of log files by a malicious user could expose credentials and jeopardize authentication to external services."}}}}, "created": "2026-01-14T11:09:30.930120+00:00", "updated": "2026-04-18T07:00:11.353261+00:00", "vendors": ["softwarepub", "softwarepub$PRODUCT$hermes"]}