CVE-2026-53869: Nousresearch Hermes-Agent

High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days.

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling attackers to exploit DNS rebinding and inject malicious commands or read terminal output.

Affected products

• Nousresearch Hermes-Agent: before 0.16.0 (fixed in 0.16.0)

Published 2026-06-17. Last modified 2026-10-08.