CVE-2026-82020: Hermes Agent Path Traversal Vulnerability

CVE-2026-82020 Overview

CVE-2026-82020 affects Hermes Agent versions 0.16.0 through releases prior to 0.17.0. The vulnerability is an improper path restriction flaw [CWE-552] in the agent's file-write tooling. Attackers who can influence ingested message content can direct the agent to overwrite the auth.json credential store. The sensitive-path guards excluded auth.json, allowing the file-write tool to bypass protection. Successful exploitation enables credential tampering and unauthorized access to resources the agent controls.

Critical Impact
An attacker with the ability to inject crafted content into messages processed by Hermes Agent can overwrite the credential store without triggering path-based safeguards, leading to credential tampering and unauthorized access.

Affected Products

Hermes Agent 0.16.0
Hermes Agent releases prior to 0.17.0
Fixed in Hermes Agent release v2026.6.19

Discovery Timeline

2026-08-28 - CVE-2026-82020 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-82020

Vulnerability Analysis

Hermes Agent exposes a file-write tool that agents invoke on behalf of user or upstream message content. The tool applies regex-based path restrictions to block writes to sensitive locations such as ~/.ssh/*, shell rc files, and credential files like ~/.netrc, ~/.pgpass, ~/.npmrc, and ~/.pypirc. The agent's own credential store, auth.json, was not included in the _CREDENTIAL_FILES set. Message content directing the agent to write to that path passed the guard checks. Attackers can weaponize this gap through indirect prompt injection channels that feed content to the agent.

Root Cause

The root cause is an incomplete allow/deny list in tools/approval.py. The _SENSITIVE_WRITE_TARGET and _USER_SENSITIVE_WRITE_TARGET regex groups did not enumerate the Hermes-managed credential file. Additionally, cp, mv, and install commands were only gated for /etc and project-relative environment or config files, not for the sensitive credential and SSH targets. This permitted overwrite operations through multiple command patterns.

Attack Vector

Exploitation requires network-reachable message ingestion and user interaction to approve or process the agent's action. An attacker crafts a message that steers the agent's tool invocation toward the credential store path. Because the path is not on the deny list, the write completes under auto-approve or with minimal user confirmation. The attacker can substitute attacker-controlled credentials or corrupt the store to force fallback authentication behavior.

python

    rf'{_SHELL_RC_FILES}|'
    rf'{_CREDENTIAL_FILES})'
)
+_USER_SENSITIVE_WRITE_TARGET = (
+    rf'(?:{_SSH_SENSITIVE_PATH}|'
+    rf'{_SHELL_RC_FILES}|'
+    rf'{_CREDENTIAL_FILES})'
+)
_PROJECT_SENSITIVE_WRITE_TARGET = rf'(?:{_PROJECT_ENV_PATH}|{_PROJECT_CONFIG_PATH})'
_COMMAND_TAIL = r'(?:\s*(?:&&|\|\||;).*)?$'

# Source: https://github.com/NousResearch/hermes-agent/commit/2b67e96aec2aa2abd5e94b544cda8e564c75f9f5

Detection Methods for CVE-2026-82020

Indicators of Compromise

Unexpected modification timestamps on auth.json or files under the Hermes configuration directory such as ~/.hermes/config.yaml.
Agent tool-call logs showing file-write invocations targeting credential store paths, SSH key locations, or shell rc files.
Authentication failures followed by successful logins from unusual sources shortly after agent activity.

Detection Strategies

Audit Hermes Agent tool invocation logs for file-write actions referencing auth.json, ~/.ssh/authorized_keys, ~/.netrc, or shell configuration files.
Correlate message ingestion events with subsequent file-write tool calls to identify prompt-injection-driven writes.
Compare deployed Hermes Agent versions against the fixed release v2026.6.19 to identify vulnerable installations.

Monitoring Recommendations

Enable file integrity monitoring on the Hermes credential directory and user SSH directory.
Alert on any process-level cp, mv, or install operations that target credential or SSH paths originating from agent runtime processes.
Track authentication anomalies against services whose credentials are stored in auth.json.

How to Mitigate CVE-2026-82020

Immediate Actions Required

Upgrade Hermes Agent to release v2026.6.19 or later, which extends the sensitive-path regex to include the credential store and gates cp, mv, and install operations against sensitive destinations.
Rotate any credentials that were stored in auth.json on vulnerable agent hosts.
Review agent message-ingestion pipelines and restrict untrusted content sources.

Patch Information

The fix is delivered across two commits in the NousResearch Hermes Agent repository. The first commit adds _USER_SENSITIVE_WRITE_TARGET coverage in tools/approval.py. The second commit adds regex patterns that gate cp, mv, and install when writing to sensitive credential, SSH, or shell rc destinations. Reference the GitHub Commit Update, the GitHub Commit Fix, the GitHub Pull Request, the GitHub Release v2026.6.19, and the VulnCheck Security Advisory.

Workarounds

Disable auto-approve for the file-write tool and require explicit human approval for every write action.
Run Hermes Agent under a restricted user account with filesystem ACLs that make auth.json, ~/.ssh/, and shell rc files read-only to the agent process.
Constrain the agent's ingestion sources to trusted content and sanitize inbound messages before they reach the tool-calling layer.

bash

# Configuration example: make the credential store immutable to the agent user
chmod 0400 ~/.hermes/auth.json
chattr +i ~/.hermes/auth.json  # Linux: prevents overwrite until removed with chattr -i