CVE-2026-17432: NousResearch hermes-agent SimpleX Gateway Authorization adapter.py access control
A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
NousResearch hermes-agent SimpleX Gateway Authorization hermes-agent/plugins/platforms/simplex/adapter.pyto a version that resolves this vulnerability.Fixed in 2026.6.5Patch 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3 - Compensating control
Because the attack may be launched remotely and results in improper access controls when contactId is manipulated, restrict remote access to the SimpleX Gateway Authorization interface (e.g., via network firewall/ACL to trusted sources only).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-17432?
CVE-2026-17432 has a medium severity rating with a score of 5.
What software is affected by CVE-2026-17432?
CVE-2026-17432 affects NousResearch hermes-agent version 2026.6.5.
How do I fix CVE-2026-17432?
To mitigate CVE-2026-17432, update to a patched version of NousResearch hermes-agent that addresses the vulnerability.
What type of vulnerability is CVE-2026-17432?
CVE-2026-17432 is an access control vulnerability affecting the SimpleX Gateway Authorization component.
What impact does CVE-2026-17432 have on system security?
CVE-2026-17432 can lead to improper authorization, potentially allowing unauthorized access to sensitive functionalities.