CVE-2026-11461: hermes-agent Authorization Bypass in Resume Endpoint

Technical summary

The vulnerability exists in the resolve_session_by_title function within hermes_state.py, which handles the resume endpoint. The authorization mechanism fails to properly validate that the authenticated user has the appropriate permissions to access the session identified by the Title parameter. This allows an authenticated attacker to bypass access controls (CWE-285) and manipulate authorization decisions (CWE-639), potentially reading or modifying data belonging to other users or sessions.

Business impact

Organizations deploying hermes-agent may face data confidentiality and integrity risks. Authenticated users with basic access could view sensitive information from other sessions or users, or alter configuration and state data. The impact scales with deployment scope—if hermes-agent is used for internal automation, session management, or data handling, unauthorized data access could expose proprietary workflows, configurations, or user information. Integrity compromise could disrupt system operations or alter audit trails.

Affected systems

NousResearch hermes-agent versions up to and including 0.12.0 are vulnerable. The affected component is the resume endpoint accessible through the resolve_session_by_title function. Any deployment running hermes-agent 0.12.0 or earlier with the resume endpoint active and user authentication enabled is at risk. Verify your installed version against NousResearch's repository or release notes.

Exploitability

This vulnerability requires an authenticated attacker (PR:L in the CVSS vector) to exploit; however, the barrier is low if an organization has multiple users or service accounts. The attack is remotely accessible and requires no special conditions or user interaction. Public disclosure of exploit details increases practical risk, as attack code may be incorporated into automated scanning tools or used by less-sophisticated threat actors. The combination of low complexity and remote accessibility makes exploitation straightforward for anyone with valid credentials.

Remediation

Upgrade hermes-agent to a version after 0.12.0 as soon as a patched release becomes available. Verify the fix is included in release notes before deploying. In the interim, implement compensating controls: restrict network access to the resume endpoint to trusted IP ranges, limit user account creation to essential personnel, monitor session-related API calls for anomalous patterns (especially unusual Title parameter values), and enforce regular password rotation for accounts with hermes-agent access.

Patch guidance

Check the NousResearch hermes-agent GitHub repository or official release channel for versions after 0.12.0 that address authorization in the resolve_session_by_title function. Verify patch release notes explicitly mention the fix for CWE-285 and CWE-639. Test the patched version in a non-production environment to confirm the resume endpoint still functions correctly and authorization checks now properly validate user permissions. Upgrade all instances in your environment simultaneously to avoid inconsistent security posture.

Detection guidance

Monitor application logs for resume endpoint requests with unusual or suspicious Title parameter values, especially requests from users accessing sessions outside their normal scope. Look for repeated failed authorization attempts on the resume endpoint or successful accesses followed by data export/modification. If authentication logs are available, correlate resume endpoint calls with user identity to identify cross-user session access. Network-level detection should flag a single authenticated user making resume requests for a high volume of distinct sessions in short timeframes, which may indicate enumeration or abuse.

Why prioritize this

While CVSS 6.3 (MEDIUM) reflects the requirement for prior authentication, the combination of public exploit disclosure and the practical risk of credential compromise (especially in environments with service accounts or shared credentials) elevates priority. Authorization bypass vulnerabilities are frequently leveraged in post-compromise scenarios where an attacker has already obtained one set of credentials. The lack of vendor response suggests patched versions may not be available immediately, making swift detection and access restriction critical. Organizations should prioritize this within their MEDIUM-severity backlog.

Risk score, explained

The CVSS 3.1 score of 6.3 reflects low attack complexity, remote network accessibility, and the requirement for a low-privilege authenticated user. Confidentiality, Integrity, and Availability impacts are each rated as LOW, meaning the attacker gains access to some but not all sensitive information, can modify some but not all data, and can degrade some but not complete system availability. The score is tempered by the authentication requirement; however, in practice, if multiple users or service accounts exist in a deployment, the effective risk is higher. Organizations with restrictive network access or single-user deployments may assess differently.

Frequently asked questions