CVE-2026-10548

MEDIUM

NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication

Title source: cna

Description

A security flaw has been discovered in NousResearch hermes-agent up to 2026.4.23. This affects the function _sync_anthropic_entry_from_credentials_file of the file agent/credential_pool.py of the component Credential Pool Synchronization. The manipulation results in improper authentication. The attack must be initiated from a local position. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

References (5)

Core 5

Core References

Vdb Entry, Technical Description vdb-entry technical-description

VDB-367645 | NousResearch hermes-agent Credential Pool Synchronization credential_pool.py _sync_anthropic_entry_from_credentials_file improper authentication

https://vuldb.com/vuln/367645

Signature, Permissions Required signature permissions-required

VDB-367645 | CTI Indicators (IOB, IOC, IOA)

https://vuldb.com/vuln/367645/cti

Third Party Advisory third-party-advisory

CVE-2026-10548 | CVE Analysis and Report

https://vuldb.com/cve/CVE-2026-10548

Third Party Advisory third-party-advisory

Submit #822026 | NousResearch hermes-agent <= v2026.4.23 Improper Authentication (CWE-287)

https://vuldb.com/submit/822026

Exploit exploit

https://gist.github.com/YLChen-007/caf38652afeccbbd53a9d77152b6198d

Scores

CVSS v3 5.3

EPSS 0.0014

EPSS Percentile 3.6%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

CISA SSVC

Vulnrichment

Exploitation poc

Automatable no

Technical Impact partial

Details

CWE

CWE-287

Status published

Products (24)

NousResearch/hermes-agent 2026.4.0

NousResearch/hermes-agent 2026.4.1

NousResearch/hermes-agent 2026.4.10

NousResearch/hermes-agent 2026.4.11

NousResearch/hermes-agent 2026.4.12

NousResearch/hermes-agent 2026.4.13

NousResearch/hermes-agent 2026.4.14

NousResearch/hermes-agent 2026.4.15

NousResearch/hermes-agent 2026.4.16

NousResearch/hermes-agent 2026.4.17

... and 14 more

Published Jun 02, 2026

Tracked Since Jun 02, 2026