What happened
NVD published CVE-2026-17432 (CVSS 5.0, Medium) on 2026-07-26, documenting an improper-authorization flaw in hermes-agent's SimpleX platform adapter where the contactId argument can be manipulated to bypass gateway authorization.
Why it matters
hermes-agent is an open-source autonomous AI agent framework from NousResearch (notable open-weight model lab); a contactId authorization bypass in its messaging gateway could let an attacker impersonate or hijack another user's conversation context with the agent, though the narrow scope (single messaging adapter) limits blast radius.
Attack vector
The hermes-agent/plugins/platforms/simplex/adapter.py component fails to properly validate the contactId argument in its SimpleX messaging gateway integration, allowing an attacker to manipulate the argument and bypass intended authorization checks for the messaging channel.
Affected systems
NousResearch hermes-agent 2026.6.5
Mitigation
Monitor the NousResearch/hermes-agent repository for a patch; restrict SimpleX gateway exposure until contactId validation is fixed.