CVE-2026-53870: Hermes Agent Information Disclosure Flaw

CVE-2026-53870 Overview

CVE-2026-53870 affects Hermes Agent versions prior to 0.16.0. The application creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644). Any local user on the host can read these files directly without authentication. The exposed data includes conversation history, tool payloads, prompts, and per-route HMAC (Hash-based Message Authentication Code) secrets. The flaw is categorized under [CWE-276: Incorrect Default Permissions].

Critical Impact
Local users can read stored conversation data and HMAC secrets, enabling forgery of authenticated webhook requests and disclosure of sensitive prompt and tool data.

Affected Products

NousResearch Hermes Agent versions prior to 0.16.0
response_store.db SQLite state store created by the gateway API server
webhook_subscriptions.json configuration created by the Hermes CLI webhook module

Discovery Timeline

2026-06-17 - CVE-2026-53870 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2026-53870

Vulnerability Analysis

Hermes Agent persists runtime state to two files on disk. The gateway API server writes a SQLite database at response_store.db containing conversation history, prompts, and tool invocation payloads. The Hermes CLI writes webhook_subscriptions.json, which stores per-route HMAC secrets used to authenticate outbound webhook calls.

Both files are created with file mode 0o644. This grants read access to every local user account on the system, not only the service principal that runs Hermes Agent. An attacker with any local shell, including unprivileged accounts and co-tenant users on shared hosts, can open these files and extract their contents directly.

Disclosure of HMAC secrets enables an attacker to forge signed webhook requests that downstream services will accept as authentic. Disclosure of the response store exposes the full prompt and tool-call history of the agent, including any sensitive data passed through it.

Root Cause

The state-writing code paths in gateway/platforms/api_server.py and hermes_cli/webhook.py did not constrain file permissions when creating the store files. The default umask and open() semantics left the files world-readable. No explicit chmod to 0o600 or use of os.open with a restrictive mode was performed.

Attack Vector

Exploitation requires local filesystem access with low privileges and no user interaction. The attacker locates the Hermes Agent working directory and reads response_store.db with any SQLite client, then parses webhook_subscriptions.json to extract HMAC secrets.

python

# Patch excerpt: gateway/platforms/api_server.py
 import sqlite3
 import time
 import uuid
+from pathlib import Path
 from typing import Any, Dict, List, Optional

# Source: https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8

python

# Patch excerpt: hermes_cli/webhook.py
 """

 import json
+import os
 import re
 import secrets
+import tempfile
 import time
 from pathlib import Path
 from typing import Dict

# Source: https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8

The patch introduces atomic writes via tempfile and explicit permission control through os.chmod, restricting access to the owning user.

Detection Methods for CVE-2026-53870

Indicators of Compromise

Presence of response_store.db or webhook_subscriptions.json with mode 0o644 or broader on hosts running Hermes Agent versions earlier than 0.16.0.
Read access events on these files by user accounts other than the Hermes service principal.
Unexpected webhook deliveries to configured endpoints accompanied by valid HMAC signatures from hosts not associated with the legitimate agent.

Detection Strategies

Audit file permissions on Hermes Agent state directories with stat -c '%a %n' response_store.db webhook_subscriptions.json and flag any mode wider than 0o600.
Enable Linux audit rules (auditd) on the Hermes data directory to log open and read syscalls and correlate the calling UID against the service account.
Inventory hosts running Hermes Agent and verify installed version against 0.16.0 or later using package metadata or the binary version string.

Monitoring Recommendations

Forward filesystem access logs and process telemetry from Hermes Agent hosts into a centralized analytics platform for cross-host correlation.
Alert on rotation or rewrite of webhook_subscriptions.json outside of scheduled maintenance windows, which may indicate post-compromise secret theft.
Monitor downstream webhook receivers for signature replay or anomalous source IPs delivering valid HMAC-signed payloads.

How to Mitigate CVE-2026-53870

Immediate Actions Required

Upgrade Hermes Agent to version 0.16.0 or the v2026.6.5 release as soon as practical.
Rotate all per-route HMAC secrets stored in webhook_subscriptions.json because prior values must be assumed disclosed on multi-user hosts.
Restrict file permissions on existing state files immediately with chmod 600 response_store.db webhook_subscriptions.json owned by the service account.

Patch Information

The fix is delivered in the security commit 3bace07 and tracked through Pull Request #30917 and Pull Request #31469. Further detail is available in the VulnCheck Advisory for Hermes Agent.

Workarounds

Apply chmod 600 and verify ownership with chown to the Hermes service user on both store files until the upgrade is deployed.
Set a restrictive umask 077 in the service unit or wrapper script that launches Hermes Agent so new files inherit owner-only permissions.
Relocate the Hermes data directory to a path with mode 0o700 owned exclusively by the service account to block traversal by other local users.

bash

# Configuration example: restrict Hermes Agent state files
install -d -m 0700 -o hermes -g hermes /var/lib/hermes
chmod 600 /var/lib/hermes/response_store.db
chmod 600 /var/lib/hermes/webhook_subscriptions.json
chown hermes:hermes /var/lib/hermes/response_store.db /var/lib/hermes/webhook_subscriptions.json

# Enforce restrictive umask in the systemd unit
# [Service]
# UMask=0077