CVE-2026-53869 Overview
CVE-2026-53869 is a DNS rebinding vulnerability in Hermes Agent versions prior to 0.16.0. The flaw resides in WebSocket endpoints handled by FastAPI, where HTTP middleware does not execute during WebSocket upgrade requests. As a result, Host and Origin header validation is bypassed on the /api/pty, /api/ws, /api/pub, and /api/events endpoints. Remote attackers can leverage DNS rebinding techniques to inject malicious commands or read terminal output from a victim's browser session. The vulnerability is tracked under [CWE-306: Missing Authentication for Critical Function].
Critical Impact
Unauthenticated network attackers can execute arbitrary commands and exfiltrate terminal output by tricking a victim's browser into connecting to attacker-controlled DNS-rebound hostnames.
Affected Products
- Hermes Agent versions prior to 0.16.0
- WebSocket endpoints: /api/pty, /api/ws, /api/pub, /api/events
- FastAPI-based deployments of Hermes Agent
Discovery Timeline
- 2026-06-17 - CVE-2026-53869 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2026-53869
Vulnerability Analysis
Hermes Agent exposes a local HTTP and WebSocket API through FastAPI. The application relies on HTTP middleware to validate the Host and Origin headers, ensuring that only trusted origins can connect to its API. However, FastAPI HTTP middleware does not run during the WebSocket upgrade handshake. This gap allows requests targeting /api/pty, /api/ws, /api/pub, and /api/events to bypass header validation entirely.
An attacker hosts a malicious page that issues WebSocket connections to a hostname under their control. Using DNS rebinding, the hostname briefly resolves to the attacker's server, then re-resolves to 127.0.0.1 or the victim's local interface. The victim's browser treats the connection as same-origin, but the WebSocket upgrade reaches the Hermes Agent listener without origin enforcement. The attacker then issues commands through /api/pty or reads terminal streams.
Root Cause
The root cause is incomplete enforcement of authentication and origin controls across protocol upgrades. Middleware-based validation was applied only to standard HTTP routes, leaving WebSocket handlers without equivalent checks. This constitutes Missing Authentication for Critical Function [CWE-306].
Attack Vector
Exploitation requires network reachability to the Hermes Agent listener and a victim browsing an attacker-controlled page. No privileges or user interaction beyond visiting the malicious site are required. The attacker uses a short-TTL DNS record to rebind the hostname after the initial page load. Subsequent WebSocket requests from the victim's browser are routed to the local Hermes Agent, where commands can be injected through the PTY endpoint and output streamed back through /api/events or /api/ws.
No verified public exploit code is available. Refer to the VulnCheck Advisory on DNS Rebinding for additional technical detail.
Detection Methods for CVE-2026-53869
Indicators of Compromise
- Unexpected WebSocket connections to /api/pty, /api/ws, /api/pub, or /api/events originating from browser user agents.
- DNS resolutions where an external hostname resolves to 127.0.0.1 or RFC1918 addresses within short intervals.
- Spawned shell processes or PTY sessions on Hermes Agent hosts that do not correlate with operator activity.
Detection Strategies
- Inspect Hermes Agent access logs for WebSocket upgrade requests carrying Origin or Host headers that do not match the expected loopback or operator-defined values.
- Correlate process execution telemetry on hosts running Hermes Agent with network connections to local listener ports.
- Deploy DNS monitoring to flag rebinding patterns where a domain alternates between public and private IP resolutions.
Monitoring Recommendations
- Enable verbose logging on the Hermes Agent WebSocket endpoints and forward logs to a centralized SIEM for review.
- Alert on PTY session creation events that originate from WebSocket handlers rather than authenticated CLI sessions.
- Track outbound DNS queries from endpoints running Hermes Agent for anomalies consistent with rebinding TTL behavior.
How to Mitigate CVE-2026-53869
Immediate Actions Required
- Upgrade Hermes Agent to version 0.16.0 or later, available in GitHub Release v2026.6.5.
- Restrict Hermes Agent network exposure so its listener is bound exclusively to 127.0.0.1 and reachable only by authorized local users.
- Audit recent WebSocket activity on /api/pty, /api/ws, /api/pub, and /api/events for unauthorized command execution.
Patch Information
The vendor addressed the issue by adding explicit Host and Origin validation inside the WebSocket handlers, independent of HTTP middleware. Review the fix in the GitHub Commit Update and the associated GitHub Pull Request #30221 and GitHub Pull Request #31685.
Workarounds
- Block external DNS resolutions that map to loopback or private address space using a local DNS resolver policy.
- Configure host-based firewall rules to drop inbound connections to Hermes Agent ports from non-loopback interfaces.
- Place Hermes Agent behind a reverse proxy that enforces strict Host and Origin checks on WebSocket upgrade requests.
# Configuration example: restrict Hermes Agent to loopback and verify version
pip install --upgrade hermes-agent>=0.16.0
hermes-agent --bind 127.0.0.1 --port 8080
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
