CVE-2026-11461
Description
A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolve_session_by_title of the file hermes_state.py of the component resume Endpoint. Such manipulation of the argument Title leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected products
2<=0.12.0+ 1 more
- (no CPE)range: <=0.12.0
- (no CPE)range: <=0.12.0
Patches
0No patches discovered yet.
Vulnerability mechanics
Root cause
"The session resolution functions perform a global database lookup without user or platform scoping."
Attack vector
An attacker can remotely trigger the vulnerability by sending a crafted request to the /resume endpoint with a victim's session title. The `resolve_session_by_title` function in `hermes_state.py` is called without any user identity context. This allows any user to bypass authorization and hijack another user's session by guessing or knowing their session title [ref_id=1]. The attack requires no elevated privileges and can be launched from any platform [ref_id=1].
Affected code
The vulnerability lies within the `resolve_session_by_title` and `get_session_by_title` functions in `hermes_state.py`. These functions execute SQL queries that lack user ID or source constraints, making all sessions accessible by title alone. The `_handle_resume_command` in `gateway/run.py` and the `_resolve_session_by_name_or_id` in `hermes_cli/main.py` call these vulnerable functions without passing the necessary identity context [ref_id=1].
What the fix does
The advisory does not specify any patches or remediation steps. It states that no versions have been patched. Therefore, the vulnerability remains unaddressed in the affected versions.
Preconditions
- inputThe attacker must know or be able to guess the title of a victim's session.
- authThe attacker needs a valid user account on the shared deployment, but no elevated privileges are required.
- networkThe attack can be launched remotely over the network.
Reproduction
1. Ensure a running Hermes Agent installation with a shared SQLite session database. 2. Execute the provided Python PoC script (`poc_exploit_minimal.py`) from a directory where `hermes_state` is importable. 3. Observe that the script successfully resolves a victim's session ID using a guessed session title and gains read/write access to the hijacked conversation [ref_id=1].
Generated on Jun 7, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
6News mentions
0No linked articles in our index yet.