CVE-2026-10548

Name of the Vulnerable Software and Affected Versions hermes-agent versions prior to 2026.4.23

Description A security flaw in the Credential Pool Synchronization component allows for improper authentication. The issue resides in the sync anthropic entry from credentials file() function within the agent/credential pool.py file. An attacker must have local access to initiate the attack.

Recommendations Update to a version later than 2026.4.23. As a temporary workaround, restrict access to the sync anthropic entry from credentials file() function in the agent/credential pool.py file.