CVE-2026-85105CWE-285CWE-639

CVE-2026-85105

High · published September 3, 2026

CVSS v3.1
7.3
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is the function _sess_nowait of the file s71.py of the component Session Management. This manipulation of the argument session_id causes authorization bypass. The attack can be initiated remotely. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.9 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00495 · 41.6th percentile
Weaknesses
CWE-285 · Improper Authorization; CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2026-09-03T17:06Z
References (4)
https://vuldb.com/cve/CVE-2026-85105 · [email protected]https://vuldb.com/submit/885131 · [email protected]https://vuldb.com/vuln/398312 · [email protected]https://vuldb.com/vuln/398312/cti · [email protected]
EPSS history
Timeline
  • 05 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 03 SEP 11:00Z
    NousResearch hermes-agent Session Management s71.py _sess_nowait authorization
    cvelistv5