Finding / hermes-agent
2026-09-21-hermes-agent-ghsa-2fmg-cjqm-hhrj-a-weak-webhook-route-could-inherit-a-privileged-sibling-s-toolsets-fix
GHSA-2fmg-cjqm-hhrj: a weak webhook route could inherit a privileged sibling’s toolsets (fixed v2026.9.21). GHSA-2fmg-cjqm-hhrj: a weak webhook route could inherit a privileged sibling’s toolsets (fixed v2026.9.21)
Channel: tagged-release. Half: defect. Date: commit 2026-09-18; tagged 2026-09-21.
Operator consequence: If any webhook route name contains “:”, upgrade to v2026.9.21 and rotate the secrets of the weaker route. Otherwise, low exposure.
Receipt
Finding metadata
Run: 2026-09-21-weekly-digest-2026-08-20_2026-09-21-frontier-v0
Finding ID: 2026-09-21-hermes-agent-ghsa-2fmg-cjqm-hhrj-a-weak-webhook-route-could-inherit-a-privileged-sibling-s-toolsets-fix
Profile citations
- Hermes Agent / claim / webhook-route-colon
Source links
Primary links, including exact changelog lines when available.