CVE-2026-53870

June 17, 2026, 8:21 p.m.

6.8
Medium

Description

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

Product(s) Impacted

Vendor Product Versions
Hermes Agent
  • Hermes Agent
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-276
Incorrect Default Permissions
During installation, installed file permissions are set to allow anyone to modify those files.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a hermes_agent hermes_agent / / / / / / / /

References

https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8
https://github.com/NousResearch/hermes-agent/pull/30917
https://github.com/NousResearch/hermes-agent/pull/31469
https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files
https://github.com/NousResearch/hermes-agent/pull/30917

Tags

CWE-276
[email protected]
2026-06-17
CVE-2026-53870

CVSS Score

6.8 / 10

CVSS Data - 4.0

  • Attack Vector: LOCAL
  • Attack Complexity: LOW
  • Attack Requirements: NONE
  • Privileges Required: LOW
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: NONE
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: June 17, 2026, 7:18 p.m.
Last Modified: June 17, 2026, 8:21 p.m.

Status : Deferred

When a CVE is given this status the NVD does not plan analyze or re-analyze this CVE due to resource or other concerns.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.