CVE-2026-11461: NousResearch hermes-agent resume Endpoint hermes_state.py resolve_session_by_title authorization
A vulnerability has been found in NousResearch hermes-agent up to 0.12.0. This affects the function resolvesessionbytitle of the file hermesstate.py of the component resume Endpoint. Such manipulation of the argument Title leads to authorization bypass. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
NousResearch hermes-agentfrom your environment.Uninstall hermes-agent from systems where it is not required, or stop the hermes-agent service, until an official fix is provided by the vendor.
- Configuration
Disable the resume Endpoint (or disable the resolve_session_by_title handler) in hermes-agent configuration or deployment until a vendor fix is available to prevent the authorization bypass.
NousResearch hermes-agent resume Endpoint (hermes_state.py resolve_session_by_title) enabled = false - Compensating control
Restrict network access to the hermes-agent/resume Endpoint using firewall rules, ACLs, or an API gateway so only trusted management IPs or internal networks can reach it; block external internet access to the service until patched.
- Operational
Monitor logs and traffic for calls to resolve_session_by_title and other suspicious resume Endpoint activity; isolate and perform forensic analysis on any hosts showing signs of exploitation and remediate affected instances.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-11461?
CVE-2026-11461 has a medium severity rating of 6.3.
How do I fix CVE-2026-11461?
To fix CVE-2026-11461, update the NousResearch hermes-agent to version 0.12.1 or later.
What component is affected by CVE-2026-11461?
CVE-2026-11461 affects the resume Endpoint in the hermes_state.py file of the NousResearch hermes-agent.
What kind of attack can exploit CVE-2026-11461?
CVE-2026-11461 can be exploited through an authorization bypass leading to remote attacks.
Which argument manipulation is involved in CVE-2026-11461?
CVE-2026-11461 involves manipulation of the Title argument in the resolve_session_by_title function.