CVE-2026-7113: NousResearch hermes-agent Webhooks Endpoint webhook.py missing authentication
A vulnerability was found in NousResearch hermes-agent 0.8.0. Affected by this issue is some unknown functionality of the file gateway/platforms/webhook.py of the component Webhooks Endpoint. The manipulation of the argument INSECURENOAUTH results in missing authentication. The attack can be launched remotely. A high complexity level is associated with this attack. The exploitation is known to be difficult. The exploit has been made public and could be used. The project was informed of the problem early through a pull request but has not reacted yet.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7113?
CVE-2026-7113 is considered a critical vulnerability due to the lack of authentication in the Webhooks Endpoint.
How do I fix CVE-2026-7113?
To fix CVE-2026-7113, implement authentication mechanisms for the Webhooks Endpoint in your implementation of NousResearch hermes-agent version 0.8.0.
What components are affected by CVE-2026-7113?
CVE-2026-7113 affects the Webhooks Endpoint functionality specifically located in the gateway/platforms/webhook.py file.
Is there a patch available for CVE-2026-7113?
As of now, there are no official patches released for CVE-2026-7113; users are encouraged to implement authentication as a mitigation strategy.
Who is responsible for the CVE-2026-7113 vulnerability?
The CVE-2026-7113 vulnerability was identified in the NousResearch hermes-agent software, specifically in version 0.8.0.