CVE-2026-53870CWE-276

CVE-2026-53870

Medium · published June 17, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
4.2
In the wild
Unconfirmed
What it is

Hermes Agent before 0.16.0 creates response_store.db and webhook_subscriptions.json with world-readable permissions (mode 0o644), exposing conversation history and HMAC secrets to local users. Attackers with local filesystem access can read these files directly to obtain sensitive data including conversation history, tool payloads, prompts, and per-route HMAC secrets.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00154 · 4.2th percentile
Weakness
CWE-276 · Incorrect Default Permissions
Published
2026-06-17T23:18Z
References (6)
https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8 · [email protected]https://github.com/NousResearch/hermes-agent/pull/30917 · [email protected]https://github.com/NousResearch/hermes-agent/pull/31469 · [email protected]https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5 · [email protected]https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files · [email protected]https://github.com/NousResearch/hermes-agent/pull/30917 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 17 JUN 17:57Z
    Hermes Agent < 0.16.0 - Sensitive File Permission Vulnerability in Store Files
    cvelistv5