Is there a patch available for CVE-2026-53870?

Yes, a patch is available for CVE-2026-53870. Update the affected software to the latest version immediately.

Hermes Agent CVE-2026-53870

Q: What is the CVSS score of CVE-2026-53870?

CVE-2026-53870 has a CVSS 4.0 base score of 6.8 (Medium). CVSS vector: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

MEDIUM

Incorrect Default Permissions (CWE-276)

2026-06-17 VulnCheck

Privilege Escalation Information Disclosure Hermes Agent Nousresearch

6.8

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.8 MEDIUM

CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

5.5 MEDIUM

Local filesystem access with low-privilege account required; high confidentiality impact from HMAC and conversation data; no integrity or availability impact from the permission flaw itself.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jun 17, 2026 - 18:46 vuln.today

Analysis Generated

Jun 17, 2026 - 18:46 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

1 pypi packages depend on hermes-agent (1 direct, 0 indirect)

Ecosystem-wide dependent count for version 0.16.0.

DescriptionCVE.org

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

AnalysisAI

Insecure default file permissions (mode 0o644) in Hermes Agent before v0.16.0 expose two sensitive data files - response_store.db and webhook_subscriptions.json - to any local user on the host system, enabling direct extraction of conversation history, tool payloads, prompts, and per-route HMAC webhook secrets. Any locally authenticated user on the same host can read these files without elevated privileges. HMAC secret exposure is particularly severe because it enables forging authenticated webhook requests, extending impact beyond passive information disclosure into potential privilege escalation - consistent with the 'Privilege Escalation' tag in the intelligence record. No public exploit has been identified at time of analysis, and this is not currently listed in CISA KEV.

Technical ContextAI

Hermes Agent is an AI agent platform developed by NousResearch (CPE: cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*) that provides conversational AI capabilities with webhook integration and tool-use support. The root cause is CWE-276 (Incorrect Default Permissions): when the application initializes its data layer, it creates response_store.db (a SQLite database containing conversation history, tool payloads, and prompts) and webhook_subscriptions.json (containing per-route HMAC secrets used to authenticate inbound webhook calls) with POSIX mode 0o644. On Linux and macOS, this grants world-read permissions - any user on the system may open and read these files without any privilege escalation. The HMAC secrets stored in webhook_subscriptions.json are used for message authentication on inbound webhook routes; their disclosure allows an attacker to compute valid HMAC signatures and send forged webhook payloads indistinguishable from legitimate ones.

RemediationAI

Upgrade to Hermes Agent v0.16.0 (v2026.6.5), which resolves the issue via commit 3bace071bfadf2d2bec2ee048471a31ec920e3e8 incorporated through PRs #30917 and #31469; the release is available at https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5. If immediate upgrade is not possible, manually restrict permissions on the affected files by running 'chmod 0600 response_store.db webhook_subscriptions.json' - this removes group and other read access, limiting reads to the owning user only; note that this is a compensating control only and will be overwritten if the application recreates the files on next start without the fix applied. Any per-route HMAC secrets stored in webhook_subscriptions.json should be rotated immediately following disclosure, as any local user who read the file before remediation may retain copies. Deploying Hermes Agent under a dedicated, non-shared service account (with no other interactive users sharing that UID or group) reduces the attack surface while patching is scheduled.