hermes-agent CVE-2026-10548

Exploitation requires an existing local operating system account with low privileges on the host running NousResearch hermes-agent (CVSS AV:L/PR:L confirmed) - remote, network-based exploitation is not possible based on available data. The hermes-agent service must be installed and the Credential Pool Synchronization feature must be active, with a credentials file present that _sync_anthropic_entry_from_credentials_file can target. No user interaction is required (UI:N). Limiting factors: the attacker cannot exploit this remotely or without any OS-level credentials; root or administrator privileges are not required but local shell access is a hard prerequisite. The attack does not require a specific non-default configuration beyond hermes-agent being installed and operational with Anthropic credentials configured.

The CVSS 3.1 base score of 5.3 (Medium) reflects a constrained attack surface: local attack vector (AV:L), low complexity (AC:L), and low privileges required (PR:L), with partial confidentiality, integrity, and availability impact (C:L/I:L/A:L) and unchanged scope. These signals indicate this is not an internet-facing, unauthenticated threat - exploitation demands pre-existing local access. However, the temporal vector qualifiers meaningfully shift real-world priority: E:P (proof-of-concept exploit publicly available) lowers the skill threshold for any attacker already on the host, RL:X (remediation level not defined) confirms no official fix, and RC:R (reasonable confidence) indicates credible but unvendor-confirmed reporting. No EPSS score was provided in the source data, and this CVE does not appear in the CISA KEV catalog, meaning automated widespread exploitation has not been observed. From an SSVC perspective: exploitation effort is low given the POC, the vulnerability is not remotely automatable, but the technical impact on credential confidentiality and integrity is material for organizations relying on hermes-agent to manage API credentials. This is a genuine medium priority for any deployment where hermes-agent handles sensitive Anthropic API keys on a multi-user or shared host - not a dismiss-as-low issue despite the CVSS score, but not an emergency patch event for air-gapped single-user installations.

An attacker with a low-privileged shell account on a shared server running hermes-agent downloads the publicly available proof-of-concept from the GitHub gist and executes it locally, invoking or manipulating _sync_anthropic_entry_from_credentials_file to bypass authentication controls and extract or substitute Anthropic API credentials from the credential pool. The attacker then uses the harvested API key to make unauthorized requests to Anthropic's API, incurring billing charges or accessing data processed through the agent.