Executive brief
Hermes Agent, an AI agent platform, was found to create sensitive data files with overly permissive access settings. This allowed any user with local access to the system to read private conversation histories, AI prompts, and security keys used for webhooks. An attacker could use this information to spy on private interactions or forge authenticated requests to connected services.
Technical details
Hermes Agent versions prior to 0.16.0 suffer from an incorrect default permissions vulnerability (CWE-276). The application created 'response_store.db' (an SQLite database containing conversation history, tool payloads, and prompts) and 'webhook_subscriptions.json' (containing per-route HMAC secrets) using a mode of 0o644. This occurred because the files inherited the process umask (typically 022) rather than being explicitly restricted. A local attacker with filesystem access can read these files to extract sensitive session data or obtain secrets to forge authenticated webhook requests. The issue was resolved in version 0.16.0 by enforcing 0o600 (owner-only) permissions during file creation and narrowing permissions on existing files during subsequent writes.
Affected products
- NousResearch hermes-agent < 0.16.0
Timeline
- 2026-05-23: disclosed: Initial security PR submitted by contributor
- 2026-05-24: patched: Fix merged into main branch
- 2026-06-05: advisory: Version 0.16.0 released with the fix
- 2026-06-17: advisory: CVE-2026-53870 published
References
- https://github.com/NousResearch/hermes-agent/commit/3bace071bfadf2d2bec2ee048471a31ec920e3e8
- https://github.com/NousResearch/hermes-agent/pull/30917
- https://github.com/NousResearch/hermes-agent/pull/31469
- https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
- https://www.vulncheck.com/advisories/hermes-agent-sensitive-file-permission-vulnerability-in-store-files