Executive brief
Hermes Agent is a messaging gateway that manages access to administrative commands. A flaw in the authorization check for quick commands allows authenticated non-admin users to bypass admin-only restrictions and execute arbitrary shell commands on the gateway server. This can lead to unauthorized command execution and system compromise.
Technical details
The vulnerability is an authorization bypass in gateway/run.py where the _check_slash_access() function is applied only to registered gateway slash commands but not to operator-configured quick_commands. An authenticated non-admin user can craft a slash command matching a configured quick_command (e.g., /limits) to bypass the allow_admin_from and user_allowed_commands policy restrictions. When the quick_command is of type "exec", the attacker can trigger shell command execution in the gateway process context. The attack requires being an authenticated allowlisted non-admin user with messaging privileges. Public exploits are available.
Affected products
- NousResearch hermes-agent up to 2026.6.5
Timeline
- 2026-06-12: disclosed
- 2026-08-04: advisory