Hermes Agent CVE-2026-53870

Exploitation requires a valid local user account on the operating system host running Hermes Agent (CVSS PR:L, AV:L). The vulnerable files response_store.db and webhook_subscriptions.json must have been created by Hermes Agent - they are generated at runtime on first use, so the agent must have been started at least once. No special Hermes Agent configuration is required; the world-readable permissions are the default in all pre-0.16.0 versions. Remote exploitation is not possible without prior OS-level access. Exploitation is limited to: (1) passive information disclosure by reading the SQLite database or JSON file directly, and (2) active webhook forgery using extracted HMAC secrets, which requires that webhook routes are configured and reachable. Deployments where Hermes Agent runs as a dedicated single-purpose service account with no other interactive local users sharing the same host are at significantly reduced risk.

The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N) accurately characterizes the exploitation profile: local access, low complexity, low privilege, no user interaction, and high confidentiality impact to the vulnerable system. Real-world risk is elevated in multi-user environments, shared hosting, containerized deployments with multiple service accounts, or CI/CD runners - any context where more than one OS-level identity runs on the same host. The HMAC secret exposure is the higher-severity sub-impact: it enables a local attacker to forge webhook requests, creating an integrity path not directly reflected in the CVSS VI:N score. EPSS data is not provided in the input and cannot be quantified from available intelligence. KEV status is not confirmed. No POC code has been identified. For single-user deployments or systems where Hermes Agent runs under a dedicated isolated account, practical risk is reduced, but the severity of HMAC key exposure warrants urgent remediation regardless.

A local user on a shared Linux server running Hermes Agent executes 'sqlite3 /path/to/response_store.db .dump' to extract the full conversation database, recovering conversation history, tool payloads, and prompt content. The attacker then reads webhook_subscriptions.json to obtain per-route HMAC keys, uses them to compute a valid HMAC-SHA256 signature over a crafted payload, and delivers a forged webhook request to the Hermes Agent instance - triggering unauthorized tool executions or configuration changes as if originating from a trusted webhook source. No public exploit code has been identified at time of analysis.