A vulnerability was detected in NousResearch hermes-agent 2026.6.5. Affected by this vulnerability is an unknown functionality of the file hermes-agent/plugins/platforms/simplex/adapter.py of the component SimpleX Gateway Authorization. The manipulation of the argument contactId results in improper access controls. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitation appears to be difficult. The exploit is now public and may be used. The patch is identified as 490c486ff65b766d9de0fe0e6f26e1778aaa8fb3. Applying a patch is advised to resolve this issue.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 1.3NVD modified 2026-10-24 13:10
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 9
- https://github.com/NousResearch/hermes-agent/
- https://github.com/NousResearch/hermes-agent/commit/490c486ff65b766d9de0fe0e6f26e1778aaa8fb3
- https://github.com/NousResearch/hermes-agent/issues/44729
- https://github.com/NousResearch/hermes-agent/issues/44730
- https://github.com/NousResearch/hermes-agent/pull/41246
- https://vuldb.com/cve/CVE-2026-17432
- https://vuldb.com/submit/862424
- https://vuldb.com/vuln/383065
- https://vuldb.com/vuln/383065/cti