Tenable TRA-2026-64: Hermes Agent Pre-Authentication Disk Consumption

Evidence record

Researcher disclosure that unbounded attacker-controlled provider strings are appended to a persistent authentication audit log before rejection. Includes test data and fix in Hermes Agent 0.21.6.

Read the original source ↗

Claim-level citations (3)

• supportsHermes Agent wrote anonymous login input to disk before rejecting it: Tenable tested a 100 MiB unauthenticated JSON request that returned 404 but reduced reported free disk space by about 100 MiB, with the attacker-controlled value retained in the audit log.

  Synopsis: 100 MiB (104,857,600 bytes) test and /api/status free-space measurements

• supportsHermes Agent wrote anonymous login input to disk before rejecting it: Tenable identifies Hermes Agent versions before 0.21.6 as affected, and says the log-consumption issue was fixed on October 5 before the October 9 advisory.

  Solution; Disclosure Timeline October 05 fixed on PR #133369; Affected Products; Advisory Timeline

• supportsHermes Agent wrote anonymous login input to disk before rejecting it: The public Hermes Agent password-login handler copied an unbounded client-provided provider string into its persistent authentication audit log before returning an unknown-provider error.

  Synopsis: POST /auth/password-login, _PasswordLoginBody.provider and dashboard-auth.log paragraphs