The report
On October 9, Tenable Research published three separate Hermes Agent dashboard vulnerabilities. The affected authentication implementation could send a login code to an unintended browser destination, consume disk space while rejecting a login, or buffer oversized anonymous requests into memory. The maintainer had already merged fixes and released Hermes Agent v0.21.6 on October 8, although that release did not update every distribution channel.
The three advisories are not three reports of one exploit, and none establishes exploitation against a production customer. They describe different trust boundaries in the same agent application's control plane.
Three separate paths through authentication
| October 9 advisory | Researcher-observed or described behavior | Maintainer correction |
|---|---|---|
| TRA-2026-65, High | Python accepted a loopback redirect_uri that the browser could navigate to another origin. Tenable reproduced misdelivery of the authorization code and described a conditional PKCE token-exchange path to session takeover. |
PR #130685, merged October 1, rejects ambiguous URI forms and reuses a canonical callback. |
| TRA-2026-64, Medium | A rejected anonymous password login copied its unbounded provider value into a persistent log. In Tenable's test, a 100 MiB request returned 404 and reduced available disk by roughly 100 MiB. |
PR #133369, merged October 5, bounds provider IDs at 128 characters and audit string values at 256 characters. |
| TRA-2026-63, Medium | Three public authentication routes parsed whole request bodies before rejection. Eight simultaneous 32 MiB uploads raised process memory from 721 MiB to 1.08 GiB in a controlled test; the status route still said overall=ok. |
PR #133370, merged October 5, introduces a 64 KiB pre-parser body limit on public authentication POSTs. |
These mechanisms affect Hermes Agent as hosted software, not the underlying model's willingness to follow a prompt. A request can fail authentication and still consume significant storage or memory; a callback can pass validation and still be delivered to a different destination. In each case, the response code alone conceals the earlier side effect or authority mismatch.
The dates and the actual upgrade boundary
Tenable says initial contact with Nous Research began on September 3. The canonical callback fix was merged October 1, the two resource-limit fixes October 5, the stable v0.21.6 release was tagged October 8, and the three advisories went public October 9. The release notes also list a separate forwarded-IP rate-limit change, which is not part of these three technical dossiers.
For deployments, the relevant question is which software actually runs. The October 8 release notes provide a Docker image and CLI update path, but explicitly say the Desktop, Termux and Microsoft Store bundles were not moved to the new release at that time. An updated source repository does not prove that every installed package has received the fix.
What the evidence establishes
The researcher documented reproducible parser and resource-exhaustion behavior. The maintainer's public pull requests provide patch designs and regression test results, including tests that fail against earlier code. Those two forms of evidence support the reported flaws and available mitigations; they do not measure how many vulnerable dashboards were externally reachable, demonstrate account takeover in the wild, or prove that an independent party retested every shipped package. Operators should verify their running version and the behavior of public authentication routes, rather than treating a repository commit or a healthy dashboard response as deployment evidence.