CVE-2026-53869: Hermes Agent < 0.16.0 - DNS Rebinding Bypass via WebSocket Endpoints

Synopsis

A DNS rebinding vulnerability in Hermes Agent before 0.16.0 allows remote attackers to bypass Host and Origin header validation on WebSocket endpoints. The FastAPI HTTP middleware responsible for enforcing those checks is skipped entirely for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events, so an attacker who can trick a user's browser into connecting to a rebinded hostname gains unauthenticated access to those endpoints. Successful exploitation crashes or disrupts the affected agent service (CVSS availability impact: High). A patched-image rebuild at version 0.16.0 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hermes Agent service over the network; the WebSocket endpoints are exposed via HTTP upgrade requests and the DNS rebinding technique requires the victim's browser to connect outbound to an attacker-controlled hostname that rebinds to the agent's IP.

• AuthenticationNot required

  No credentials are needed; the middleware bypass means the attacker skips Host and Origin validation entirely without presenting any account or token.

• Victim interactionRequired

  The DNS rebinding technique requires a victim to visit an attacker-controlled web page that initiates the WebSocket connection from the victim's browser, making user interaction a necessary part of the attack chain.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and imposes no special environmental conditions beyond the DNS rebinding setup; no race conditions or memory-layout dependencies are involved.

Blast Radius

• Crashes or renders the Hermes Agent service unavailable, disrupting any terminal sessions or event streams depending on the /api/pty, /api/ws, /api/pub, and /api/events endpoints.
• Injects malicious commands into an active terminal session via the /api/pty WebSocket endpoint.
• Reads live terminal output streamed over /api/pty or /api/events without authorization.