NousResearch hermes-agent CVE-2026-17432

Exploitation requires ALL of: (1) the SimpleX Gateway adapter enabled in hermes-agent; (2) the operator having configured SIMPLEX_ALLOWED_USERS with contacts' human display names rather than numeric contactIds (a non-default choice, but one the UI actively encourages since it only surfaces display names) - if the allowlist uses numeric contactIds the bug is not reachable; (3) the attacker being an established SimpleX contact able to message the agent; and (4) the attacker knowing an allowlisted display-name value to impersonate. The attacker then renames their self-asserted profile displayName (source.user_name) to that value. Limiting factors: high attack complexity (AC:H), the non-default and knowledge-dependent allowlist configuration, and the need for prior contact establishment - all consistent with the description's 'exploitation appears to be difficult'. Impact is limited to unauthorized authorization into the agent, not code execution.

This is a genuine-but-low-priority issue whose signals are internally consistent - no inflated CVSS to correct here. The vendor CVSS 4.0 base score is 1.3 (AV:N/AC:H/PR:L/UI:N with only VC:L/VI:L/VA:L partial impacts), EPSS is 0.23% (14th percentile), and SSVC records Exploitation=poc, Automatable=no, Technical Impact=partial. All four frameworks agree this is low-severity, non-automatable, and only partially impactful. POC is public but there is NO CISA KEV listing, so exploitation status is publicly available exploit code exists - not active exploitation; the two must not be conflated. The high attack complexity (AC:H) is corroborated by both the description ('high complexity level', 'exploitation appears to be difficult') and the source diff: the flaw only bites when an operator populates the SIMPLEX_ALLOWED_USERS allowlist with human display names AND the attacker knows an allowlisted name to impersonate. The attack vector is nominally network (SimpleX messaging), but reach requires being an established SimpleX contact of the agent, which tempers the 'remote' framing. Net: a real authorization-bypass logic bug worth patching on niche deployments, but not an urgent, widely-exploitable priority.

An operator runs hermes-agent's SimpleX gateway and populates SIMPLEX_ALLOWED_USERS with a trusted contact's human display name (which the SimpleX UI naturally surfaces) rather than the numeric contactId. A malicious SimpleX contact edits their own self-asserted profile display name to match an allowlisted value, then sends a direct message; the gateway's _is_user_authorized() matched the attacker-controlled profile name and grants them agent access. Public exploit/POC code is referenced in the CVE (GitHub issue #44729), but there is no evidence of active exploitation.