CVE-2026-82020

Executive Summary

CVE-2026-82020 is an improper path restriction vulnerability (CWE-552) affecting Hermes Agent versions 0.16.0 through 0.16.x. The flaw allows an attacker who can influence ingested message content to bypass sensitive-path guards and overwrite the agent's credential store (auth.json). This enables credential tampering, potentially leading to unauthorized access to downstream systems the agent interacts with. The vulnerability carries a CVSS score of 6.8 (High) and currently has no public exploit code, proof-of-concept, or available patch — affected deployments remain exposed until an upgrade to version 0.17.0+ is released.

Technical Analysis

The vulnerability resides in Hermes Agent's file-write tooling, specifically in how path validation is enforced prior to write operations. Hermes Agent 0.16.0 implements a sensitive-path exclusion mechanism designed to prevent the agent's file-write capabilities from modifying critical files such as the credential store (auth.json). However, due to an improper path restriction, this protection is insufficient.

The root cause is a bypass in the path-based guard logic. The guard appears to perform string-based or normalized-path comparisons to detect whether a target path is inside a protected directory (e.g., the credential store location). Attackers can craft malicious message content that directs the file-write tooling to a path that resolves to the same underlying file but is expressed differently — such as using relative path segments (../), absolute vs. relative resolution divergences, symlink indirection, or alternate path separators. Because the guard fails to canonicalize or fully resolve the target path before comparison, the crafted path avoids triggering the exclusion rule, and the write operation proceeds.

The attack surface is the agent's message ingestion pipeline. Any entity capable of submitting message content to the agent — whether through a chat interface, an API endpoint, a queue, or a webhook — can supply a malicious instruction. The vulnerability class is path traversal (improper restriction of operations within the bounds of a memory buffer / path), which here manifests against a file-write primitive rather than a read primitive.

No specific function names, API endpoints, or code-level identifiers beyond auth.json are provided in the NVD description; therefore, the exact guard implementation cannot be characterized further. The vulnerability is classified under CWE-552 (Files or Directories Accessible to External Parties), indicating the core issue is improper restriction of file operations relative to trusted boundaries.

The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) reveals important characteristics:

• Attack Vector: Network — exploitation can be conducted remotely.
• Attack Complexity: High — conditions must be carefully crafted; the attacker needs knowledge of the agent's working directory and path-resolution behavior.
• Privileges Required: None — no pre-authentication is needed.
• User Interaction: Required — the agent (or its operator) must process the malicious message.
• Confidentiality & Integrity: High — successful exploitation either exfiltrates credential data (read) or modifies it (overwrite).
• Availability: None — the attack does not cause a denial of service.

Exploitation Scenarios

Step 1 — Reconnaissance / Target Identification:
An attacker must first identify a Hermes Agent 0.16.0–0.16.x instance. This can be achieved by fingerprinting exposed agent interfaces, monitoring for default agent identifiers in HTTP responses, or observing message queues. Publicly accessible agent dashboards or message relays are the most likely entry points.

Step 2 — Triggering the Flaw:
The attacker crafts a message instructing the agent's file-write tooling to overwrite auth.json. Because the path-based guard excludes the literal path to auth.json, the attacker must manipulate the path representation to bypass the guard. Techniques plausible for this vulnerability class include:

• Using relative traversal (../../etc/... or ../auth.json) where the resolving logic differs from the guard's checking logic.
• Exploiting path normalization divergences (e.g., the guard checks the raw string, the write tool resolves the real path).
• Leveraging symlinks: if a writable directory contains a symlink pointing to auth.json, writing "through" the symlink path may bypass the exclusion check.

Step 3 — Payload / Execution Method:
At the vulnerability-class level (path traversal bypass), the payload is the malicious message itself. It contains a directive to call the file-write tool with a crafted path. No additional code execution is required — the agent's native tooling performs the write, and the bypass is achieved purely via path manipulation. The agent executes the write operation with its own privileges, which are sufficient to modify the credential store.

Step 4 — Post-Exploitation Impact:
Successful overwrite of auth.json results in credential tampering. The attacker can inject their own credentials or invalidate existing ones. Outcomes include:

• Credential Substitution: The attacker replaces stored credentials with ones they control, gaining authenticated access to downstream services on the next agent operation.
• Denial of Service via Credential Corruption: Overwriting with malformed data forces re-authentication failures, disrupting the agent's normal operations.
• Privilege Escalation: If the overwritten credentials correspond to a higher-privileged service account, the attacker inherits that access level.

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and NVD description. Specific path-bypass techniques (symlinks, traversal, normalization) are hypotheses based on common CWE-552 patterns and must be validated against the actual deployment.

Proof of Concept Intelligence

Exploitation remains possible despite the absence of a public PoC. The vulnerability class (path restriction bypass) is well-understood, and several generic bypass techniques are documented in security research for similar agents and file-write tools. A determined attacker with knowledge of Hermes Agent's internal path handling could independently derive a working bypass.

Resources to monitor for future PoC disclosure:

1. GitHub Advisories & Issue Tracker: Hermes Agent's official repository and security advisories — watch for CVE-2026-82020 references or fixed-version announcements.
2. Exploit-DB & Packet Storm: Monitor for new exploit submissions tagged under Hermes or CWE-552.
3. Multiple CVE feeds (NVD, Red Hat, MITRE): Sign up for email alerts on CVE-2026-82020.
4. Security researcher blogs / Twitter/X: Follow researchers who historically publish PoCs for agent-based file-write vulnerabilities.
5. Dark web / Telegram monitoring (per organizatoin policy): Exploit brokers may offer or discuss PoCs privately before public disclosure.

Impact Assessment

Business Impact: High. Hermes Agent operates as an autonomous or semi-autonomous assistant that interacts with external systems via stored credentials. Compromising the credential store compromises the integrity of every downstream integration the agent manages. An attacker can pivot from credential tampering to unauthorized access of cloud APIs, databases, or internal services.

Affected Systems: All deployments running Hermes Agent 0.16.0 through 0.16.x. The NVD description does not specify geographic or vertical concentration; however, adopters of Hermes Agent in automation-heavy environments (DevOps, customer support, IT operations) are most at risk.

Blast Radius:

• Confidentiality (C:H): Credential data is exfiltratable if the attacker chooses a read-based path abuse, though the NVD emphasizes the overwrite vector.
• Integrity (I:H): Direct and complete — credential store contents can be replaced.
• Availability (A:N): No direct DoS, but credential corruption can cause indirect unavailability of downstream services.
• CVSS 6.8 (High): The combination of low barrier to entry (no privileges needed, network vector) balanced by high attack complexity and required user interaction yields a serious but not critical score.

Detection Guidance

Detection of exploitation attempts for this CWE-552 path-bypass vulnerability should focus on anomalous file-write operations initiated by the agent, especially writes targeting credential files, and on abnormal path expressions in agent tool-call arguments.

Sigma Rule

title: Hermes Agent Credential Store Overwrite via Path Bypass
id: 39a5c0f2-7d4e-4b1a-9c3f-8d2e6e1a4b5c
status: experimental
description: Detects file write operations by Hermes Agent targeting auth.json or credential paths with anomalous path expressions
logsource:
    category: process_creation
    product: linux
detection:
    selection_tool:
        Image|endswith: '/hermes-agent'
    selection_path:
        CommandLine|contains:
            - 'auth.json'
            - 'credentials'
    selection_anomaly:
        CommandLine|contains:
            - '../'
            - '..\\'
            - 'symlink'
            - '/proc/self/fd/'
    condition: selection_tool and selection_path and selection_anomaly
level: high
falsepositives:
    - Legitimate administrator actions modifying credential stores directly
    - Automated configuration management tools performing credential rotation
tags:
    - attack.t1539
    - cve.2026.82020
    - cwe.552

YARA Rule

rule Hermes_Agent_Credential_Path_Bypass
{
    meta:
        author = "Valter Security Intelligence"
        description = "Detects suspicious path bypass patterns targeting Hermes Agent credential store"
        cve = "CVE-2026-82020"
        date = "2026-01-01"
        severity = "high"
    strings:
        $s1 = "auth.json" ascii wide nocase
        $s2 = "file-write" ascii wide nocase
        $s3 = "../" ascii wide
        $s4 = "..\\" ascii wide
        $s5 = "write_file" ascii wide nocase
        $s6 = "save_credentials" ascii wide nocase
    condition:
        any of ($s1, $s2, $s5, $s6) and any of ($s3, $s4)
}

Note: This YARA rule detects generic path-bypass indicators in agent messages or command logs; adjust for actual tool naming.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-82020 - Hermes Agent Credential Overwrite Attempt"; flow:to_server,established; content:"/auth.json"; http_uri; content:"../"; http_uri; content:"Hermes"; http_user_agent; nocase; classtype:attempted-admin; sid:2026820201; rev:1; metadata:cve CVE-2026-82020, cwe CWE-552;)

Note: This rule assumes HTTP telemetry carrying agent commands. Adjust to match actual transport (e.g., MQTT, WebSocket).

Elastic Detection

file where event.action == "write" and process.name == "hermes-agent" and file.name == "auth.json" and process.command_line : ("*../*", "*..\\*", "*/etc/*")

Alternative if command-line lacks path:

any where event.category == "file" and file.path : "*auth.json" and process.name == "hermes-agent" and (file.path : "*../*" or file.path : "*..\\*")

Splunk SPL Query

index=main sourcetype=linux_audit OR sourcetype=sysmon
| where process_name="hermes-agent" OR Image="*/hermes-agent"
| search command_line="*auth.json*" OR file_path="*auth.json*"
| search command_line="*../*" OR command_line="*..\\*" OR file_path="*../*" OR file_path="*..\\*"
| table _time, host, user, process_name, command_line, file_path, file_name
| stats count by host, command_line

Wazuh OSSEC Rule

<group name="hermes_agent,">
  <rule id="138833" level="10">
    <if_sid>925</if_sid>
    <match>auth\.json</match>
    <regex>\.\./|\.\.\\</regex>
    <description>Hermes Agent attempted to write to credential store with traversal path</description>
    <group>pci_dss_6.5,gdpr_IV_35.7.d,</group>
  </rule>
</group>

Note: Adjust base ruleset (if_sid) to your Wazuh deployo ment.

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED. No patch evidence exists from any tracked source. The vulnerability affects version 0.16.x; a fix is anticipated in version 0.17.0 but has not been released as of this report.

Immediate Mitigations (until patch is available):

1. Restrict Inbound Message Sources: Deny untrusted entities from sending messages to the agent. Use allowlists on the message ingestion endpoints (API keys, network ACLs, queue-level permissions).
2. Remove or Restrict File-Write Tooling: If the agent's file-write capability is not essential, disable it via configuration. If it must remain, constrain it to a sandboxed directory using OS-level permissions (e.g., run agent as an unprivileged user with write access only to a dedicated workspace directory).
3. Harden auth.json Permissions: Set the credential store file to read-only for the agent's user (chmod 444 auth.json). This prevents overwrite even if the path guard is bypassed, breaking the exploitation primitive at the OS level.
4. Monitor auth.json Integrity: Deploy a file integrity monitoring (FIM) solution that alerts on any modification to auth.json — even if written by the agent process.
5. Isolate the Agent: Run Hermes Agent in a container with a seccomp profile or AppArmor/SELinux policy that denies writes to the credential store directory except through a controlled API.

Patch / Upgrade Steps:

1. Subscribe to Hermes Agent security announcements and the project's GitHub releases.
2. As soon as version 0.17.0 is published, test it in a staging environment that mirrors your deployment.
3. After validating the fix (verify that path-bypass attempts against auth.json are blocked), upgrade production agents.
4. If 0.17.0 is never released and the project is abandoned, adopt an alternative agent solution or fork the project with the path-restriction fix applied.

Long-Term Hardening:

1. Apply the principle of least privilege: Run the agent with the minimum set of filesystem permissions required for its legitimate functions.
2. Require manual approval for sensitive operations: If feasible, modify agent configuration to require human confirmation before any write to credential-adjacent files.
3. Implement credential vaulting: Move credentials out of local files entirely into a secrets manager (e.g., HashiCorp Vault, AWS Secrets Manager) accessible to the agent via short-lived tokens.
4. Periodic security review: Re-evaluate all agent tooling for similar path-validation flaws, as CWE-552 can reappear in other file operations (e.g., file-read tooling, backup routines).

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-82020
2. CWE-552 - Files or Directories Accessible to External Parties: https://cwe.mitre.org/data/definitions/552.html
3. Hermes Agent Project (official repository for version tracking): https://github.com/hermes-agent/hermes-agent (returned 404 — verify manually)
4. CISA Known Exploited Vulnerabilities Catalog (not listed): https://www.cisa.gov/known-exploited-vulnerabilities-catalog
5. MITRE ATT&CK Technique T1539 - Steal Web Session Cookie: https://attack.mitre.org/techniques/T1539/

Threat Actor Activity: No known threat actor campaigns have been linked to CVE-2026-82020 as of this report. No exploit-in-the-wild evidence is available. The vulnerability remains a high-priority remediation target due to the sensitive nature of the affected asset (credential store) despite the absence of active exploitation reports.