Hermes Agent CVE-2026-82020

Exploitation requires two concrete prerequisites: (1) the attacker must be able to inject or control content within messages ingested by the target Hermes Agent instance - viable attack surfaces include any platform integration the agent is configured to accept, such as Raft agent network messages, iMessage via the Photon plugin, or other external channel adapters; and (2) the agent must process (passively consume) the malicious message (UI:P in CVSS 4.0), meaning the attack is not fire-and-forget but depends on agent activity. The High attack complexity (AC:H) further limits exploitation to scenarios where the attacker can reliably influence the specific message stream the agent consumes. PR:N confirms no pre-existing authentication to the target system is required. Limiting factors include: agents configured to ingest only from fully trusted internal sources are substantially less exposed; agents running with OS-level write restrictions on auth.json are protected even if the path guard is bypassed; and the requirement for the agent to actively process the crafted message prevents purely passive or pre-authentication attacks.

The CVSS 4.0 score of 7.6 is driven by network accessibility (AV:N) and high confidentiality and integrity impact (VC:H/VI:H), tempered by high attack complexity (AC:H) and passive user interaction (UI:P). The AC:H constraint is significant: exploitation requires that the attacker control or corrupt a message source that the target Hermes Agent instance actively ingests, which is a non-trivial precondition. The UI:P metric indicates the agent must actually process the malicious message, reducing the automation potential. No KEV listing exists and no public exploit code has been identified at time of analysis; EPSS data was not provided in the intelligence package, so exploitation probability cannot be quantified numerically. Despite the lower immediate exploitation likelihood, the impact ceiling is high: overwriting auth.json grants the attacker control over all credentials stored by the agent, enabling lateral movement across every service the agent is authenticated to. Organizations using Hermes Agent with broad message ingestion surfaces - such as multi-user team deployments accepting input from Raft, iMessage, or other external channels - face meaningfully higher exposure than single-user local-only deployments. The patch is available and should be prioritized given the severity of the potential impact on credential integrity.

An attacker with access to a message channel ingested by Hermes Agent - such as a compromised upstream Raft agent node or a maliciously crafted iMessage delivered via the Photon integration - sends a payload instructing the agent's file-write tool to write attacker-controlled content to a path that resolves to auth.json, bypassing the path exclusion guard through normalization inconsistency. The agent processes the message without triggering any alert, overwrites the credential store with attacker-chosen content, and the attacker subsequently authenticates to downstream services using the newly planted credentials. No public exploit code has been identified at time of analysis.