CVE-2026-22798CWE-532

hermes's raw options logging may disclose secrets passed in via subcommand options argument

Medium · published January 12, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
6.3
In the wild
Unconfirmed
What it is

hermes is an implementation of the HERMES workflow to automatize software publication with rich metadata. From 0.8.1 to before 0.9.1, hermes subcommands take arbitrary options under the -O argument. These have been logged in raw form. If users provide sensitive data such as API tokens (e.g., via hermes deposit -O invenio_rdm.auth_token SECRET), these are written to the log file in plain text, making them available to whoever can access the log file. This vulnerability is fixed in 0.9.1.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00172 · 6.3th percentile
Weakness
CWE-532 · Insertion of Sensitive Information into Log File
Published
2026-01-12T22:00Z
EPSS history
Timeline
  • 12 JAN 22:00Z
    hermes's raw options logging may disclose secrets passed in via subcommand options argument
    cvelistv5