Is there a public PoC exploit available for CVE-2026-7112?

Yes, a public proof-of-concept exploit is available for CVE-2026-7112. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-7112?

Yes, a patch is available for CVE-2026-7112. Update the affected software to the latest version immediately.

NousResearch hermes-agent CVE-2026-7112

Q: What is the CVSS score of CVE-2026-7112?

CVE-2026-7112 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25812 LOW

Improper Authentication (CWE-287)

2026-04-27 VulDB

Authentication Bypass Hermes Agent

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 10:30 vuln.today

CVSS changed

Apr 27, 2026 - 10:22 NVD

5.6 (MEDIUM) 6.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 10:00 euvd

EUVD-2026-25812

Analysis Generated

Apr 27, 2026 - 10:00 vuln.today

Patch released

Apr 27, 2026 - 10:00 nvd

Patch available

CVE Published

Apr 27, 2026 - 09:45 nvd

LOW 2.9

DescriptionCVE.org

A vulnerability has been found in NousResearch hermes-agent 0.8.0. Affected by this vulnerability is the function _check_auth of the file gateway/platforms/api_server.py of the component API_SERVER_KEY Handler. The manipulation leads to improper authentication. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Improper authentication in the API_SERVER_KEY handler of NousResearch hermes-agent 0.8.0 allows remote attackers to bypass authentication checks in the _check_auth function via the API server component. The vulnerability has a CVSS score of 6.3 with high attack complexity, and publicly available exploit code exists. The project has not yet responded to early notification via pull request.

Technical ContextAI

The vulnerability exists in the gateway/platforms/api_server.py component of hermes-agent, specifically within the _check_auth function responsible for validating API_SERVER_KEY authentication tokens. CWE-287 (Improper Authentication) indicates the root cause is a flaw in the authentication mechanism itself-likely an insufficient or bypassable validation routine. The API_SERVER_KEY handler is a critical security component that should enforce strict authentication for remote API access, but the implementation permits attackers to circumvent these checks through manipulation of the authentication logic or request parameters.

RemediationAI

The primary remediation is to apply the available patch via GitHub pull request #6477 (https://github.com/NousResearch/hermes-agent/pull/6477), which addresses the _check_auth function's authentication bypass. Users should upgrade to the patched version once released. Until patch deployment, restrict network access to the API server component using firewall rules or network segmentation, limiting connectivity to trusted internal networks only. Implement additional authentication layers (e.g., API gateway authentication, mutual TLS) upstream of hermes-agent to compensate for the local authentication bypass. Monitor API_SERVER_KEY authentication logs for failed authentication attempts or suspicious patterns. Disable the API server component entirely if not required for operation, eliminating the attack surface.