MEDIUM

CVE-2026-53870

2026-06-17 CVSS v3.1

CVSS

5.5

Description

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

Weakness (CWE)

CWE-276 Incorrect Default Permissions

EPSS Score

0.11%

Probability of exploitation in next 30 days

1.4th percentile

References

https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8 https://github.com/NousResearch/hermes-agent/pull/30917 https://github.com/NousResearch/hermes-agent/pull/31469 https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5 https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE