Executive brief
A security flaw in the NousResearch hermes-agent, a tool used for managing AI agent credentials, can lead to an authentication bypass. When the system encounters rate limits while using Anthropic services, it incorrectly synchronizes all stored account tokens with a single local configuration file. This causes multiple isolated user accounts to be overwritten by a single identity, potentially leading to unauthorized access or service disruptions across different accounts.
Technical details
An authentication bypass vulnerability exists in the `CredentialPool` of `hermes-agent` up to version 2026.4.23. The flaw is located in the `_sync_anthropic_entry_from_credentials_file` function within `agent/credential_pool.py`. When the agent encounters an HTTP 429 rate limit error, it attempts to rotate credentials and synchronizes exhausted tokens with a global configuration file (`~/.claude/.credentials.json`). Because this synchronization lacks proper scoping, it overwrites all distinct pool entries with the contents of the singleton global file. A local attacker can exploit this to collapse multi-account credential pools into a single identity, breaching authorization boundaries. As of the advisory date, the vendor has not responded to the disclosure.
Affected products
- NousResearch hermes-agent <= 2026.4.23
Timeline
- 2026-05-07: other: Vulnerability research and PoC developed
- 2026-06-01: advisory: VulDB published advisory
- 2026-06-02: disclosed: NVD publication date