CVE-2026-10548

NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication

State: Published
Severity: 4.8 Medium
Published: Jun 2, 2026
Updated: Jun 3, 2026
Reserved: Jun 1, 2026

Read the record on cve.org

Description

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.23. This affects the function _sync_anthropic_entry_from_credentials_file of the file agent/credential_pool.py of the component Credential Pool Synchronization. The manipulation results in improper authentication. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Scores

CVSS	Score	Vector	Source
4.0	4.8 Medium	CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P	VulDB
3.1	5.3 Medium	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
3.0	5.3 Medium	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:R	VulDB
2.0	4.3 Medium	AV:L/AC:L/Au:S/C:P/I:P/A:P/E:POC/RL:ND/RC:UR	VulDB

Weaknesses

CWE-287 Improper Authentication

Affected Products

Product	Versions
hermes-agentNousResearch	2026.4.0Affected 2026.4.1Affected 2026.4.2Affected 2026.4.3Affected 2026.4.4Affected 2026.4.5Affected 2026.4.6Affected 2026.4.7Affected 2026.4.8Affected 2026.4.9Affected 2026.4.10Affected 2026.4.11Affected 2026.4.12Affected 2026.4.13Affected 2026.4.14Affected 2026.4.15Affected 2026.4.16Affected 2026.4.17Affected 2026.4.18Affected 2026.4.19Affected 2026.4.20Affected 2026.4.21Affected 2026.4.22Affected 2026.4.23Affected

Product

Versions

hermes-agentNousResearch

2026.4.0Affected
2026.4.1Affected
2026.4.2Affected
2026.4.3Affected
2026.4.4Affected
2026.4.5Affected
2026.4.6Affected
2026.4.7Affected
2026.4.8Affected
2026.4.9Affected
2026.4.10Affected
2026.4.11Affected
2026.4.12Affected
2026.4.13Affected
2026.4.14Affected
2026.4.15Affected
2026.4.16Affected
2026.4.17Affected
2026.4.18Affected
2026.4.19Affected
2026.4.20Affected
2026.4.21Affected
2026.4.22Affected
2026.4.23Affected

References

VDB-367645 | NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authenticationvdb-entrytechnical-description
VDB-367645 | CTI Indicators (IOB, IOC, IOA)signaturepermissions-required
CVE-2026-10548 | CVE Analysis and Reportthird-party-advisory
Submit #822026 | NousResearch hermes-agent <= v2026.4.23 Improper Authentication (CWE-287)third-party-advisory
https://gist.github.com/YLChen-007/caf38652afeccbbd53a9d77152b6198dexploit

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.