CVE-2026-82020

Hermes Agent 0.16.0 prior to 0.17.0 fails to properly restrict the paths its file-write tooling can touch, allowing attackers to bypass the sensitive-path guards that were supposed to exclude the auth.json credential store from writes. An attacker who can influence the content of messages ingested by the agent can craft malicious message content that directs the agent's file-write tooling to overwrite the credential store without triggering any path-based protection. Successful exploitation enables credential tampering — replacing or corrupting stored credentials — which can lead to unauthorized access. Only deployments running affected Hermes Agent versions that ingest content from sources an attacker can influence are exposed. No public proof-of-concept, KEV listing, or known exploitation exists, and EPSS estimates only a 0.3% probability of exploitation in the next 30 days.

What to do: Upgrade to Hermes Agent 0.17.0 or later, which restores proper sensitive-path protection for the auth.json credential store. Until upgraded, limit the agent's ingestion of untrusted message content and monitor auth.json for unexpected modifications. If auth.json was changed without a legitimate reason, rotate the stored credentials and check for signs of unauthorized access.