CVE-2026-82020

Katalog CVE

CVSS 6.8 · Medium EPSS 0,43%

Kerentanan Files or Directories Accessible to External Parties. Skor CVSS 3.1 6.8 (Medium) menurut vulncheck.com.

Deskripsi (NVD)

Hermes Agent 0.16.0 prior to 0.17.0 contains an improper path restriction vulnerability that allows attackers who can influence ingested message content to overwrite the credential store by bypassing sensitive-path guards that excluded the auth.json file. Attackers can craft malicious messages directing the agent's file-write tooling to overwrite the credential store without triggering any path-based protection, enabling credential tampering or unauthorized access.

Rincian

Terbit di NVD

28 Agustus 2026

Terakhir diubah

8 September 2026

Status NVD

Deferred

CVSS 3.1

6.8 (Medium), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-552: Files or Directories Accessible to External Parties

EPSS (30 hari)

0,43% peluang dieksploitasi; lebih tinggi dari 36,0% CVE lain

Produk dan versi terdampak

NVD belum mencantumkan data produk (CPE) untuk CVE ini. Produk yang terdampak biasanya disebut di deskripsi dan di advisory vendor pada daftar referensi.

Referensi dan perbaikan

• https://github.com/NousResearch/hermes-agent/commit/2b67e96aec2aa2abd5e94b544cda8e564c75f9f5
• https://github.com/NousResearch/hermes-agent/commit/da28d5d113956dcf803d5cff552a120740a96a59
• https://github.com/NousResearch/hermes-agent/pull/45821
• https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.19
• https://www.vulncheck.com/advisories/hermes-agent-credential-store-overwrite-via-file-write-tool