hermes-agent CVE-2026-11461

The attacker must possess a valid low-privileged account on the target hermes-agent instance, as confirmed by the CVSS vector PR:L - unauthenticated actors cannot exploit this without first obtaining credentials. The vulnerability is triggered specifically via the resume endpoint's title parameter, which is passed directly to resolve_session_by_title in hermes_state.py; the instance must be running with the resume functionality accessible over the network. No special network position, race condition, or elevated privilege is required (AC:L, AV:N). Exploitation is bounded to authenticated users, and the scope is unchanged (S:U), meaning the vulnerability does not enable cross-privilege-boundary escalation beyond the session data itself. The absence of a vendor patch means there is no configuration toggle to disable the vulnerable code path without modifying the source.

The CVSS base score of 6.3 (Medium) reflects AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L - network-reachable, low complexity, requiring only low-privileged authentication with no user interaction and unchanged scope. Each impact dimension is rated Low, suggesting partial rather than full compromise. However, the temporal vector E:P (proof-of-concept exists) is corroborated by a public GitHub Gist PoC, elevating real-world exploitation probability beyond the base score alone. RC:R (reasonable confidence) indicates the finding has not yet been independently confirmed by the vendor. No EPSS score was provided, and the CVE is not listed in CISA KEV, so no confirmed active exploitation is indicated - only publicly available exploit code exists. The vendor's non-response to pre-disclosure notification removes the typical confidence signal of vendor confirmation, meaning affected version ranges and the absence of a patch cannot be independently verified from the vendor side. In multi-user or API-facing deployments where session data contains sensitive agent instructions or outputs, the real-world impact may exceed what the Low impact ratings suggest.

A publicly available proof-of-concept exploit exists at https://gist.github.com/YLChen-007/c2d162e9c8d39584223683cdcba98607. An attacker with a valid low-privileged account sends a crafted HTTP request to the hermes-agent resume endpoint, supplying the known or guessed title of another user's agent session as the title argument. Because resolve_session_by_title performs no ownership or authorization check before returning the session object, the attacker can read sensitive session state or resume and redirect the victim's agent session.