CVE-2026-17432: Hermes-Agent Auth Bypass Vulnerability

CVE-2026-17432 Overview

CVE-2026-17432 is an improper access control vulnerability [CWE-266] affecting NousResearch hermes-agent version 2026.6.5. The flaw resides in the SimpleX Gateway Authorization component, specifically in hermes-agent/plugins/platforms/simplex/adapter.py. Manipulation of the contactId argument allows an attacker to bypass the SIMPLEX_ALLOWED_USERS allowlist enforcement. The vendor has published a fix identified by commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. The exploit is public but the attack requires high complexity, and successful exploitation is considered difficult.

Critical Impact
An authenticated remote attacker with low privileges can bypass SimpleX contact allowlisting by leveraging a mismatch between numeric contact IDs and display names, resulting in unauthorized access to the hermes-agent gateway.

Affected Products

NousResearch hermes-agent 2026.6.5
Component: SimpleX Gateway Authorization (hermes-agent/plugins/platforms/simplex/adapter.py)
Configuration variable: SIMPLEX_ALLOWED_USERS

Discovery Timeline

2026-07-26 - CVE-2026-17432 published to NVD
2026-07-27 - Last updated in NVD database
Patch commit - 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 published to the Hermes Agent repository

Technical Details for CVE-2026-17432

Vulnerability Analysis

The hermes-agent SimpleX adapter enforces user authorization through the SIMPLEX_ALLOWED_USERS environment variable. Before the patch, the allowlist was documented and evaluated as a comma-separated list of numeric contact IDs only. The adapter internally sets user_id=contactId for stability across contact renames.

However, the SimpleX user interface never surfaces the numeric contact ID to operators. Operators therefore commonly populate the allowlist with display names instead of numeric IDs. When the enforcement logic compared incoming contactId values against display-name entries, no match occurred, and the allowlist silently failed open or closed depending on configuration. This mismatch constitutes an improper access control condition classified under [CWE-266] (Incorrect Privilege Assignment).

Root Cause

The root cause is inconsistent identity resolution between configuration and enforcement. The adapter accepted only numeric contactId values in its authorization check, while operators supplied display names in SIMPLEX_ALLOWED_USERS. The manipulation of the contactId argument by an attacker who can influence display-name resolution results in allowlist bypass.

Attack Vector

The attack is launched remotely over the network and requires low privileges (an authenticated SimpleX contact context). Attack complexity is high because the attacker must interact with a misconfigured deployment where display names were used in the allowlist. The public exploit describes the manipulation path via the contactId parameter handled by the SimpleX adapter.

python

# Security patch excerpt - plugins/platforms/simplex/adapter.py
# Source: https://github.com/NousResearch/hermes-agent/commit/490c486ff65b766d9de0fe0e6f26e1778aaa8fb3

            if normalized_user_id:
                check_ids.add(normalized_user_id)

+        # SimpleX: SIMPLEX_ALLOWED_USERS accepts either the numeric contactId
+        # or the contact's display name. The adapter sets user_id=contactId for
+        # stability across renames, but the SimpleX UI never surfaces the
+        # numeric id — operators only see display names, so that's what they
+        # naturally put in the env var. Match both so the allowlist works
+        # regardless of which form was chosen.
+        if (
+            source.platform is not None
+            and source.platform.value == "simplex"
+            and source.user_name
+        ):
+            check_ids.add(source.user_name)
+
        return bool(check_ids & allowed_ids)

The patch adds source.user_name (the display name) to the set of identifiers checked against SIMPLEX_ALLOWED_USERS, closing the identity-resolution gap.

Detection Methods for CVE-2026-17432

Indicators of Compromise

Unexpected SimpleX contact interactions with the hermes-agent gateway from contactId values not present in SIMPLEX_ALLOWED_USERS.
Gateway log entries showing successful command handling for contacts whose display names were assumed to be allowlisted but whose numeric IDs were not.
Presence of hermes-agent version 2026.6.5 without commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 applied.

Detection Strategies

Audit deployed SIMPLEX_ALLOWED_USERS values and confirm whether entries are numeric contact IDs or display names.
Compare the deployed adapter.py and gateway/run.py against the patched revision to verify the display-name check is present.
Correlate SimpleX gateway authorization events with expected operator-defined allowlist entries to identify silent bypass patterns.

Monitoring Recommendations

Enable verbose logging on the SimpleX adapter to record both contactId and user_name on every authorization decision.
Alert on any authorization success for a contactId that does not appear in a canonical, ID-based allowlist.
Track deployments of hermes-agent by commit hash to detect unpatched hosts.

How to Mitigate CVE-2026-17432

Immediate Actions Required

Update hermes-agent to the revision containing commit 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 from the Hermes Agent repository.
Review current SIMPLEX_ALLOWED_USERS values and confirm they represent the intended set of authorized contacts.
Rotate or invalidate any suspicious SimpleX contacts observed interacting with the gateway prior to patching.

Patch Information

The fix is delivered in GitHub commit 490c486. The patch modifies both gateway/run.py and plugins/platforms/simplex/adapter.py so that SIMPLEX_ALLOWED_USERS accepts either a numeric contactId or a contact display name. Additional context is available in GitHub Issue #44729, Issue #44730, and Pull Request #41246. VulDB tracks the entry as VulDB Vulnerability #383065.

Workarounds

Populate SIMPLEX_ALLOWED_USERS with the numeric contactId values retrieved via the SimpleX CLI /contacts command rather than display names, until the patch can be applied.
Restrict gateway network exposure to trusted networks to limit remote reachability.
Set SIMPLEX_ALLOW_ALL_USERS explicitly to false and confirm the value is honored in the running configuration.

bash

# Retrieve numeric contactId values from the SimpleX CLI, then set the allowlist
# using IDs (not display names) as a pre-patch workaround.
export SIMPLEX_ALLOWED_USERS="12345,67890"
export SIMPLEX_ALLOW_ALL_USERS="false"