Is there a public PoC exploit available for CVE-2026-7113?

Yes, a public proof-of-concept exploit is available for CVE-2026-7113. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-7113?

Yes, a patch is available for CVE-2026-7113. Update the affected software to the latest version immediately.

NousResearch Hermes-Agent CVE-2026-7113

Q: What is the CVSS score of CVE-2026-7113?

CVE-2026-7113 has a CVSS 4.0 base score of 2.9 (Low). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-25818 LOW

Missing Authentication for Critical Function (CWE-306)

2026-04-27 VulDB

Authentication Bypass Hermes Agent

2.9

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

2.9 LOW

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Severity Changed

Apr 29, 2026 - 01:12 NVD

MEDIUM LOW

CVSS changed

Apr 29, 2026 - 01:12 NVD

6.3 (MEDIUM) 2.9 (LOW)

PoC Detected

Apr 29, 2026 - 01:00 vuln.today

Public exploit code

Analysis Generated

Apr 27, 2026 - 11:30 vuln.today

CVSS changed

Apr 27, 2026 - 11:22 NVD

5.6 (MEDIUM) 6.3 (MEDIUM)

EUVD ID Assigned

Apr 27, 2026 - 11:00 euvd

EUVD-2026-25818

Analysis Generated

Apr 27, 2026 - 11:00 vuln.today

Patch released

Apr 27, 2026 - 11:00 nvd

Patch available

CVE Published

Apr 27, 2026 - 10:00 nvd

LOW 2.9

DescriptionCVE.org

A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of the component Webhooks Endpoint. The manipulation of the argument _INSECURE_NO_AUTH results in missing authentication. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.

AnalysisAI

Authentication bypass in hermes-agent 0.8.0 webhook endpoint allows remote attackers to bypass authentication controls via manipulation of the _INSECURE_NO_AUTH parameter, resulting in limited confidentiality and integrity impact. The vulnerability requires high attack complexity and has publicly available exploit code; vendor patch is available but the project has not yet merged the fix despite early notification.

Technical ContextAI

The vulnerability exists in the Webhooks Endpoint component, specifically in the gateway/platforms/webhook.py file. The root cause is CWE-306 (Missing Authentication Check), where the _INSECURE_NO_AUTH parameter is processed without proper validation, allowing attackers to manipulate authentication logic. This appears to be a feature flag or debug parameter that was left accessible in production code without appropriate guards. The webhook endpoint in Python frameworks like Flask or FastAPI typically handles incoming HTTP requests; if authentication checks are conditionally bypassed based on an unsanitized parameter, remote clients can craft requests that skip authentication entirely.

RemediationAI

Apply the vendor-released patch available in GitHub pull request #6445 to hermes-agent. Organizations should update to the patched version as soon as testing permits. Immediate compensating control: disable or restrict network access to the webhook endpoint (gateway/platforms/webhook.py) if the service is not in active use, reducing the attack surface. If the endpoint must remain accessible, implement network-level authentication such as mutual TLS (mTLS), IP allowlisting, or reverse proxy authentication to validate requests before they reach the application layer. Verify that the _INSECURE_NO_AUTH parameter is not accessible in production configurations; if found in environment variables or config files, remove it immediately. After patching, conduct a review of webhook request logs to detect any prior exploitation attempts.