Which versions of Hermes Agent are affected by CVE-2026-53869?

NousResearch Hermes Agent versions below 0.16.0 are vulnerable to DNS rebinding attacks (CVSS 8.7) that allow remote attackers to bypass access controls and inject commands into privileged terminal…. A patch is available.

How to fix or mitigate CVE-2026-53869?

Within 24 hours: Identify and document all Hermes Agent deployments running versions prior to 0.16.0, including network location and access scope. Within 7 days: Upgrade all affected instances to Hermes Agent version 0.16.0 or later and validate deployment integrity. Within 30 days: Audit access logs for exploitation attempts, verify patching completion across infrastructure, and review network segmentation around agent instances.

Hermes Agent CVE-2026-53869

Q: What is the CVSS score of CVE-2026-53869?

CVE-2026-53869 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.6%.

HIGH

Missing Authentication for Critical Function (CWE-306)

2026-06-17 VulnCheck

GHSA-4pqm-j46f-795x

Authentication Bypass Hermes Agent Nousresearch

8.7

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.5 HIGH

Network-reachable WebSocket with no auth (AV:N, PR:N), but DNS rebinding requires winning a TTL race (AC:H) and a victim browsing an attacker page (UI:R); PTY command injection yields full C/I/A:H.

3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:45 vuln.today

Analysis Generated

Jun 17, 2026 - 18:45 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on hermes-agent (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.16.0.

DescriptionCVE.org

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.

AnalysisAI

DNS rebinding in NousResearch Hermes Agent prior to 0.16.0 allows remote attackers to reach privileged local WebSocket endpoints (/api/pty, /api/ws, /api/pub, /api/events) by tricking a victim's browser into resolving an attacker-controlled hostname to the agent's loopback address, bypassing Host and Origin checks. Because FastAPI HTTP middleware does not run on WebSocket upgrade requests, the validation layer is silently skipped, letting attackers inject commands into the PTY or stream terminal output. No public exploit has been identified at time of analysis, but VulnCheck reported the issue and an upstream patch is available.

Technical ContextAI

Hermes Agent exposes a FastAPI-based local control plane that brokers a pseudo-terminal (/api/pty), generic WebSocket channel (/api/ws), pub/sub (/api/pub), and server-sent events (/api/events). The vendor relies on HTTP middleware to enforce Host/Origin allow-lists as a defense against cross-origin attacks from a browser context, but Starlette/FastAPI runs middleware only on the HTTP request path - WebSocket upgrades short-circuit that pipeline and reach the endpoint handlers directly. This matches CWE-306 (Missing Authentication for Critical Function): a security-critical check exists in code but is not invoked on a reachable code path, so the WebSocket endpoints behave as if unauthenticated when targeted via DNS rebinding (where a malicious site rebinds its A record to 127.0.0.1 after the same-origin check is satisfied).

RemediationAI

Vendor-released patch: Hermes Agent 0.16.0 (release tag v2026.6.5, https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5); the fix corresponds to upstream commit d9ec90585cf7616b5972e44cf8d92bb569fc3feb and PRs #30221 and #31685, which move Host/Origin validation into a WebSocket-aware dependency so it runs on upgrade requests. Operators who cannot upgrade immediately should bind the agent to a non-loopback interface only behind an authenticating reverse proxy, or firewall outbound DNS for the agent's listening host so browser-driven rebinding cannot resolve external names to 127.0.0.1 - note this breaks any legitimate browser-based local UI. As a lighter compensating control, restrict the listening port with a host firewall rule that allows only the local user's browser process (per-app firewall) or disable the /api/pty endpoint via configuration if PTY access is not needed, accepting loss of in-browser terminal features. Consult the VulnCheck advisory at https://www.vulncheck.com/advisories/hermes-agent-dns-rebinding-bypass-via-websocket-endpoints for current guidance.