CVE-2026-53869
2 advisories.
PyPI/hermes-agent CVE-2026-53869: high 7.5
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
Action: Upgrade hermes-agent to 0.16.0 or later.
pip install hermes-agent==0.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.16.0 | - |
Fixed versions
| 0.16.0 |
Sources
- osv: GHSA-4pqm-j46f-795x
- https://nvd.nist.gov/vuln/detail/CVE-2026-53869
- https://github.com/NousResearch/hermes-agent/pull/30221
- https://github.com/NousResearch/hermes-agent/pull/31685
- https://github.com/NousResearch/hermes-agent/commit/d9ec90585cf7616b5972e44cf8d92bb569fc3feb
- https://github.com/NousResearch/hermes-agent
- https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
- https://www.vulncheck.com/advisories/hermes-agent-dns-rebinding-bypass-via-websocket-endpoints
CVE-2026-53869 · published · modified · JSON
PyPI/hermes-agent CVE-2026-53869: high 7.5
Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation
Action: Upgrade hermes-agent to 0.16.0 or later.
pip install hermes-agent==0.16.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.16.0 | - |
Fixed versions
| 0.16.0 |
Sources
- osv: PYSEC-2026-2510
- https://nvd.nist.gov/vuln/detail/CVE-2026-53869
- https://github.com/NousResearch/hermes-agent/pull/30221
- https://github.com/NousResearch/hermes-agent/pull/31685
- https://github.com/NousResearch/hermes-agent/commit/d9ec90585cf7616b5972e44cf8d92bb569fc3feb
- https://github.com/NousResearch/hermes-agent
- https://github.com/NousResearch/hermes-agent/releases/tag/v2026.6.5
- https://www.vulncheck.com/advisories/hermes-agent-dns-rebinding-bypass-via-websocket-endpoints
- https://pypi.org/project/hermes-agent
- https://github.com/advisories/GHSA-4pqm-j46f-795x
CVE-2026-53869 · published · modified · JSON