CVE-2026-53869: Hermes Agent DNS Rebinding WebSocket Vulnerability (v0.16.0)

Technical summary

CVE-2026-53869 is a DNS rebinding vulnerability in Hermes Agent's WebSocket implementation. FastAPI HTTP middleware that enforces Host and Origin validation does not execute for WebSocket upgrade requests on the /api/pty, /api/ws, /api/pub, and /api/events endpoints. An attacker can exploit this by initiating a DNS rebinding attack—first resolving attacker.com to the victim's IP, establishing a WebSocket connection, then updating DNS to resolve to the attacker's server for subsequent requests. This allows the attacker to bypass hostname/origin checks and interact with protected endpoints from the browser's perspective as same-origin. The vulnerability is classified as CWE-306 (Missing Authentication for Critical Function).

Business impact

This vulnerability enables unauthorized command injection and information disclosure on systems running vulnerable Hermes Agent instances. An attacker can execute arbitrary commands through the terminal API endpoint (/api/pty) or eavesdrop on session data through the publish/events endpoints (/api/pub, /api/events). For organizations using Hermes Agent for remote administration or monitoring, this represents a direct path to lateral movement, privilege escalation, or data exfiltration without needing credentials. The attack surface includes any user whose browser visits an attacker-controlled website while authenticated to a vulnerable Hermes Agent instance.

Affected systems

Hermes Agent versions prior to 0.16.0 are affected. The vulnerability specifically impacts the WebSocket endpoints: /api/pty (pseudo-terminal), /api/ws (generic WebSocket), /api/pub (publish), and /api/events (event streaming). Organizations should audit deployed instances to identify running versions and network exposure of these endpoints.

Exploitability

This vulnerability has a CVSS 3.1 score of 7.5 (HIGH) with a network attack vector, low complexity, and no authentication or user interaction required. However, practical exploitation requires the target user to visit attacker-controlled content while maintaining an active authenticated session with Hermes Agent. The attack is not trivial—it requires DNS rebinding conditions and browser-based attack delivery—but once conditions align, the impact is severe: unauthenticated command execution or data access.

Remediation

Upgrade Hermes Agent to version 0.16.0 or later. This version applies FastAPI middleware security checks to WebSocket upgrade requests, closing the validation bypass. Organizations should also consider network-level mitigations: restrict WebSocket endpoint access via firewall rules, use DNS pinning or DNSSEC validation on client systems, and deploy Content Security Policy (CSP) headers to limit cross-origin WebSocket initiation.

Patch guidance

Upgrade to Hermes Agent 0.16.0 immediately for affected deployments. Verify patch application by checking the running version via the agent's health/version endpoint. Test WebSocket connectivity to monitored endpoints after patching to ensure operational continuity. For organizations unable to patch immediately, isolate Hermes Agent instances to trusted networks only and require VPN access, reducing browser-based attack surface.

Detection guidance

Monitor for unusual WebSocket connection attempts to /api/pty, /api/ws, /api/pub, and /api/events endpoints with mismatched Host or Origin headers. DNS rebinding attacks may present as legitimate connections followed by rapid DNS resolution changes. Check Hermes Agent logs for commands or data access from unexpected sources. Review proxy/load balancer logs for WebSocket upgrade requests lacking proper authentication context. Network-level detection should flag DNS queries where the same hostname resolves to multiple IPs within a short timeframe targeting your infrastructure.

Why prioritize this

This vulnerability merits immediate attention due to its HIGH CVSS score, unauthenticated attack vector, and critical impact (command injection and data disclosure). Although practical exploitation requires specific conditions—victim visiting attacker content while authenticated—the barrier is not prohibitively high in environments where users access untrusted websites. Given the nature of Hermes Agent (remote administration/monitoring), compromise enables full system control and is difficult to detect post-exploitation.

Risk score, explained

The CVSS 3.1 score of 7.5 reflects network-based access, low attack complexity, and no authentication requirement. The score emphasizes availability impact (denial via command execution) but should be contextualized as also carrying high confidentiality and integrity risk through command injection and data exfiltration capabilities. Organizations with Hermes Agent exposed to untrusted users or networks should treat this as a critical remediation priority despite the 7.5 rating.

Frequently asked questions