Description
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.
Published: 2026-07-26
Score: 2.3 Low
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The SimpleX Gateway Authorization adapter in NousResearch hermes-agent contains a flaw that allows an attacker to modify the contactId argument, leading to improper access controls. This vulnerability exposes the system to unauthorized access of protected resources or functions that should require proper authentication or authorization. This flaw is an instance of improper authorization (CWE‑284) and weak access control (CWE‑266). The security impact is a breach of confidentiality or integrity of data accessed through the gateway.

Affected Systems

The vulnerability affects the NousResearch hermes-agent, specifically version 2026.6.5. The component at issue is the SimpleX Gateway Authorization adapter located in hermes-agent/plugins/platforms/simplex/adapter.py. No other products or versions are listed as impacted in the available data.

Risk and Exploitability

The CVSS score of 2.3 indicates low severity, and the EPSS score of less than 1% reflects a very low likelihood of exploitation. The vulnerability can be triggered remotely, and the description states that a high level of technical complexity is required, thus making exploitation difficult. The issue is not cataloged in CISA’s KEV list.

Generated by OpenCVE AI on August 3, 2026 at 18:18 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor patch corresponding to commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 to hermes-agent
  • Review and enforce proper authentication and authorization checks around the contactId parameter in the SimpleX Gateway Authorization component
  • Monitor system logs for anomalous access attempts to the SimpleX Gateway endpoint

Generated by OpenCVE AI on August 3, 2026 at 18:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sun, 26 Jul 2026 01:00:00 +0000

Type Values Removed Values Added
Description A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.
Title NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
First Time appeared Nousresearch
Nousresearch hermes-agent
Weaknesses CWE-266
CWE-284
CPEs cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*
Vendors & Products Nousresearch
Nousresearch hermes-agent
References
Metrics cvssV2_0

{'score': 4.6, 'vector': 'AV:N/AC:H/Au:S/C:P/I:P/A:P/E:POC/RL:OF/RC:C'}

cvssV3_0

{'score': 5, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV3_1

{'score': 5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:O/RC:C'}

cvssV4_0

{'score': 2.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-27T18:01:13.928Z

Reserved: 2026-07-25T10:42:39.965Z

Link: CVE-2026-17432

cve-icon Vulnrichment

Updated: 2026-07-27T18:01:09.525Z

cve-icon NVD

Status : Deferred

Published: 2026-07-26T01:16:25.783

Modified: 2026-07-27T20:25:13.817

Link: CVE-2026-17432

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-03T18:30:06Z

Weaknesses
  • CWE-266

    Incorrect Privilege Assignment

  • CWE-284

    Improper Access Control