CVE-2026-53870: Hermes Agent World-Readable Database and HMAC Secret Exposure

Technical summary

CVE-2026-53870 is a local privilege escalation and information disclosure vulnerability in Hermes Agent prior to version 0.16.0. The application creates response_store.db and webhook_subscriptions.json with world-readable file permissions (0o644) during initialization. This permission mode allows any local user to read these files. The response_store.db contains encrypted and plaintext conversation history, tool execution parameters, and system prompts. The webhook_subscriptions.json file stores per-route HMAC secrets used for webhook authentication. An attacker with local filesystem access can read both files directly to extract sensitive data without requiring elevated privileges or exploiting additional vulnerabilities. The root cause is improper file permission handling during file creation, classified under CWE-276 (Incorrect Default Permissions).

Business impact

This vulnerability creates a multi-layered data exposure risk. Conversation history extraction reveals proprietary prompts, internal tool integrations, and customer interactions processed by the agent. HMAC secret disclosure allows attackers to forge valid webhook requests to downstream systems, potentially triggering unauthorized actions. For organizations running Hermes Agent in multi-tenant or shared server environments, this creates a clear path for internal threat actors or compromised low-privilege accounts to exfiltrate sensitive data and escalate impact. The blast radius depends on what conversations are stored and which external systems rely on webhook authentication.

Affected systems

Hermes Agent versions 0.15.x and earlier are vulnerable. The vulnerability is resolved in version 0.16.0 and later. Affected deployments include any installation where the agent is running on systems with multiple local users or where low-privilege service accounts have filesystem access. Environments without local multi-user access or with strict filesystem permission controls mitigate the risk but do not eliminate it if initial permissions are set incorrectly at deployment time.

Exploitability

Exploitability is straightforward for any user with local filesystem access to the Hermes Agent installation directory or data directory. No special tools, network access, or privilege escalation exploits are required—standard filesystem read operations suffice. This makes the attack path trivial for internal users, compromised service accounts, or any process running under a different user context. The CVSS vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects this: local attack vector, low attack complexity, low-privilege attacker required, no user interaction, high confidentiality impact, no integrity or availability impact.

Remediation

Upgrade Hermes Agent to version 0.16.0 or later, which corrects file permission handling during database and configuration file creation. For organizations unable to upgrade immediately, apply filesystem-level controls: restrict read access to the agent's data directory to the service account or user running the agent. Use chmod 0600 on response_store.db and webhook_subscriptions.json, and 0700 on the parent directory. Audit existing deployments to identify any plaintext or accessible copies of these files and rotate any exposed HMAC secrets used for webhook authentication.

Patch guidance

Update to Hermes Agent version 0.16.0 or later. Verify the update by confirming the file version reported by the application and by checking that response_store.db and webhook_subscriptions.json are created with restrictive permissions (0600) after the update. Test in a non-production environment first to ensure compatibility. After patching, manually verify or re-apply filesystem ACLs if your deployment uses additional permission layers. Existing files created under the old vulnerable code should be manually corrected or removed and recreated by the patched version.

Detection guidance

Check for response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644 or 0o664) in your Hermes Agent installation directories. Use `find /path/to/agent -perm /044 -type f -name 'response_store.db' -o -name 'webhook_subscriptions.json'` to locate vulnerable file permissions. Audit filesystem access logs for unexpected reads of these files from non-service-account processes. Review webhook authentication logs for anomalous or forged HMAC signatures that may indicate secret compromise. Confirm the Hermes Agent version running in production; versions below 0.16.0 are vulnerable by default unless manually hardened post-deployment.

Why prioritize this

Medium CVSS score reflects the local attack vector and privilege requirement, but the combination of trivial exploitability, exposure of cryptographic secrets, and conversation history disclosure makes this a priority for any environment with multi-user or shared server deployment models. Organizations with strict single-user deployments or hardened filesystem policies face lower risk but should still patch to prevent misconfiguration-induced exposure. The ease of exploitation and sensitivity of exposed data (authentication credentials and proprietary prompts) warrant rapid patching cycles.

Risk score, explained

CVSS 5.5 (Medium) is driven by high confidentiality impact—conversation history and HMAC secrets are fully readable—but zero integrity and availability impact because the attacker can only read, not modify or disrupt service. The local attack vector (AV:L) and low privilege requirement (PR:L) reduce the absolute score compared to remote vulnerabilities but do not diminish the sensitivity of what is exposed. In shared hosting or multi-user server contexts, this score understates practical risk; in single-user or isolated deployments, it may overstate it. Risk should be calibrated to your deployment model.

Frequently asked questions