CVE-2026-7112

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-7112", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "state": "PUBLISHED", "assignerShortName": "VulDB", "dateReserved": "2026-04-26T15:54:42.744Z", "datePublished": "2026-04-27T09:45:11.517Z", "dateUpdated": "2026-04-27T12:21:26.650Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T09:45:11.517Z"}, "title": "NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication", "problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-287", "lang": "en", "description": "Improper Authentication"}]}], "affected": [{"vendor": "NousResearch", "product": "hermes-agent", "versions": [{"version": "0.8.0", "status": "affected"}], "modules": ["API_SERVER_KEY Handler"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api_server.py of the component API_SERVER_KEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet."}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P", "baseSeverity": "MEDIUM"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R", "baseSeverity": "MEDIUM"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "timeline": [{"time": "2026-04-26T00:00:00.000Z", "lang": "en", "value": "Advisory disclosed"}, {"time": "2026-04-26T02:00:00.000Z", "lang": "en", "value": "VulDB entry created"}, {"time": "2026-04-26T18:00:04.000Z", "lang": "en", "value": "VulDB entry last update"}], "credits": [{"lang": "en", "value": "Yu-Bao (VulDB User)", "type": "reporter"}, {"lang": "en", "value": "VulDB CNA Team", "type": "coordinator"}], "references": [{"url": "https://vuldb.com/vuln/359712", "name": "VDB-359712 | NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359712/cti", "name": "VDB-359712 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/800800", "name": "Submit #800800 | NousResearch hermes-agent 0.8.0 Unauthenticated Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NousResearch/hermes-agent/issues/6439", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/NousResearch/hermes-agent/pull/6477", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/NousResearch/hermes-agent/", "tags": ["product"]}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-27T12:21:19.774754Z", "id": "CVE-2026-7112", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:21:26.650Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-7112", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-27T12:21:19.774754Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-27T12:21:23.165Z"}}], "cna": {"title": "NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication", "credits": [{"lang": "en", "type": "reporter", "value": "Yu-Bao (VulDB User)"}, {"lang": "en", "type": "coordinator", "value": "VulDB CNA Team"}], "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P"}}, {"cvssV3_1": {"version": "3.1", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV3_0": {"version": "3.0", "baseScore": 5.6, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R"}}, {"cvssV2_0": {"version": "2.0", "baseScore": 5.1, "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:UR"}}], "affected": [{"vendor": "NousResearch", "modules": ["API_SERVER_KEY Handler"], "product": "hermes-agent", "versions": [{"status": "affected", "version": "0.8.0"}]}], "timeline": [{"lang": "en", "time": "2026-04-26T00:00:00.000Z", "value": "Advisory disclosed"}, {"lang": "en", "time": "2026-04-26T02:00:00.000Z", "value": "VulDB entry created"}, {"lang": "en", "time": "2026-04-26T18:00:04.000Z", "value": "VulDB entry last update"}], "references": [{"url": "https://vuldb.com/vuln/359712", "name": "VDB-359712 | NousResearch hermes-agent API_SERVER_KEY api_server.py _check_auth improper authentication", "tags": ["vdb-entry", "technical-description"]}, {"url": "https://vuldb.com/vuln/359712/cti", "name": "VDB-359712 | CTI Indicators (IOB, IOC, IOA)", "tags": ["signature", "permissions-required"]}, {"url": "https://vuldb.com/submit/800800", "name": "Submit #800800 | NousResearch hermes-agent 0.8.0 Unauthenticated Remote Code Execution", "tags": ["third-party-advisory"]}, {"url": "https://github.com/NousResearch/hermes-agent/issues/6439", "tags": ["exploit", "issue-tracking"]}, {"url": "https://github.com/NousResearch/hermes-agent/pull/6477", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/NousResearch/hermes-agent/", "tags": ["product"]}], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api_server.py of the component API_SERVER_KEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-287", "description": "Improper Authentication"}]}], "providerMetadata": {"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "shortName": "VulDB", "dateUpdated": "2026-04-27T09:45:11.517Z"}}}, "cveMetadata": {"cveId": "CVE-2026-7112", "state": "PUBLISHED", "dateUpdated": "2026-04-27T12:21:26.650Z", "dateReserved": "2026-04-26T15:54:42.744Z", "assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5", "datePublished": "2026-04-27T09:45:11.517Z", "assignerShortName": "VulDB"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"modules": ["API_SERVER_KEY Handler"], "product": "hermes-agent", "vendor": "NousResearch", "versions": [{"status": "affected", "version": "0.8.0"}]}], "source": "cna@vuldb.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api_server.py of the component API_SERVER_KEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet."}, {"lang": "es", "value": "Una vulnerabilidad ha sido encontrada en NousResearch hermes-agent 0.8.0. Afectada por esta vulnerabilidad es la funci\u00f3n _check_auth del archivo gateway/platforms/api_server.py del componente API_SERVER_KEY Gestor. La manipulaci\u00f3n conduce a una autenticaci\u00f3n impropia. El ataque puede ser iniciado remotamente. La complejidad de un ataque es bastante alta. La explotaci\u00f3n parece ser dif\u00edcil. El exploit ha sido divulgado al p\u00fablico y puede ser usado. El proyecto fue informado del problema tempranamente a trav\u00e9s de una pull request pero no ha reaccionado a\u00fan."}], "id": "CVE-2026-7112", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "HIGH", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.1, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 4.9, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "cna@vuldb.com", "type": "Secondary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.6, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 3.4, "source": "cna@vuldb.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 2.9, "baseSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "PROOF_OF_CONCEPT", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "cna@vuldb.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-7112", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-27T12:21:19.774754Z", "version": "2.0.3"}}]}, "published": "2026-04-27T10:16:10.533", "references": [{"source": "cna@vuldb.com", "url": "https://github.com/NousResearch/hermes-agent/"}, {"source": "cna@vuldb.com", "url": "https://github.com/NousResearch/hermes-agent/issues/6439"}, {"source": "cna@vuldb.com", "url": "https://github.com/NousResearch/hermes-agent/pull/6477"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/submit/800800"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359712"}, {"source": "cna@vuldb.com", "url": "https://vuldb.com/vuln/359712/cti"}], "sourceIdentifier": "cna@vuldb.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}], "source": "cna@vuldb.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "0.8.0"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hermes-agent", "source": "cna", "vendor": "NousResearch"}, "product": "hermes-agent", "vendor": "nousresearch"}], "analysis": {"en": {"generated_at": "2026-04-28T04:37:28.479303+00:00", "value": {"mitigation_remediation": ["Check for and install the official patch from NousResearch once it is available (the pull request addressing this issue is currently unmerged).", "If a patch is not available, limit network access to the API_SERVER_KEY endpoint to trusted hosts only, such as by implementing firewall rules or network segmentation.", "Review and strengthen the authentication logic in the _check_auth function, ensuring it validates all authentication tokens and credentials correctly.", "Enable logging and alerting for failed authentication attempts and monitor logs for suspicious activity."], "summary": {"action": "Patch Now", "impact": "Unauthorized Access"}, "threat_synthesis": {"affected_systems": "The affected product is NousResearch's hermes\u2011agent, version 0.8.0. Only this release is identified; no other versions or variants are listed. The vulnerability specifically targets the API_SERVER_KEY component exposed within the agent's gateway module.", "description_and_impact": "The vulnerability originates from the _check_auth function in gateway/platforms/api_server.py of the API_SERVER_KEY Handler. An attacker can manipulate requests to bypass authentication checks, allowing unauthorized access to the API. Because the flaw permits remote exploitation and can lead to full control over the system, it presents an authentication bypass (CWE\u2011287) that threatens confidentiality, integrity, and availability.", "risk_and_exploitability": "The CVSS score of 6.3 marks the issue as moderate severity, and the EPSS value of < 1\u202f% indicates a low likelihood of exploitation at present. The issue has not yet been recorded in the CISA KEV catalog, suggesting no publicly known exploitation campaigns. Attackers would need to initiate the exploit remotely against the API, a task characterized as high complexity and difficult, so the overall risk is moderate but should be considered in environments where the agent services sensitive data."}}}}, "created": "2026-04-28T04:45:22.545921+00:00", "updated": "2026-04-28T09:17:17.706337+00:00", "vendors": ["nousresearch", "nousresearch$PRODUCT$hermes-agent"]}