This vulnerability in NousResearch hermes-agent affects versions up to 2026.4.23 and is located in the _sync_anthropic_entry_from_credentials_file function of agent/credential_pool.py. It causes improper authentication, potentially allowing an attacker with local access to bypass authentication controls. The exploit code is publicly available, increasing the risk of exploitation. No official remediation or patch has been provided by the vendor, who has not responded to disclosure attempts.

Improper authentication can allow a local attacker to bypass intended authentication mechanisms, potentially leading to unauthorized access or actions within the hermes-agent environment. The CVSS 4.8 score reflects a medium severity with local attack vector and low complexity. The presence of a public exploit increases the likelihood of exploitation despite the requirement for local access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or released a fix, users should restrict local access to trusted personnel only and monitor for suspicious activity related to hermes-agent until an official patch or mitigation is available.