{"repo":"NousResearch/hermes-agent","public_id":"126756","display_label":"A2A trusted-peer allowlist fail-open security fix","summary":"A security issue where the A2A trusted-peer allowlist fails open (permits all peers) when no allowlist is configured on non-loopback network bindings. Multiple related fixes address this by enforcing fail-closed behavior in that scenario.","subsystem":null,"counts":{"members":6,"open_issues":0,"open_issues_distinct":0,"open_prs":0,"closed_issues":1,"merged_prs":1,"attempt_prs":4},"landed_fix":{"status":"merged_to_main","basis":"structural","pr":130516},"resolution":{"state":"resolved","by":"pr-130516"},"freshness":{"state":"verified","last_verified_at":"2026-10-01T19:15:34+00:00","is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.3333333333333333},"fix_edges":[{"issue_number":126756,"pr_number":130516,"tier":"verified","basis":"closing_ref","confidence":0.95,"recoverable_from_timeline":true}],"members":[{"kind":"issue","number":126756,"title":"[Security] A2A trusted-peer allowlist fails open when no allowlist is configured","url":null,"state":"closed"},{"kind":"pr","number":126775,"title":"fix(a2a): fail closed when a network-exposed adapter has no trusted-peer allowlist","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4fb768fcda","number":0},{"kind":"pr","value":"#130310","number":130310},{"kind":"pr","value":"#130516","number":130516}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":127431,"title":"fix(security): fail closed when A2A trusted-peer allowlist is empty (closes #126756)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4fb768fcda","number":0},{"kind":"pr","value":"#127608","number":127608},{"kind":"pr","value":"#130516","number":130516}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":127608,"title":"fix(security): fail closed when A2A trusted-peer allowlist is empty on non-loopback bind","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4fb768fcda","number":0},{"kind":"pr","value":"#130516","number":130516}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":130310,"title":"fix(a2a): fail closed on non-loopback bind with empty trusted-peers allowlist (#126756)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"4fb768fcda","number":0},{"kind":"pr","value":"#130516","number":130516}],"category":"merged_via","implication":"superseded"},"merged":false},{"kind":"pr","number":130516,"title":"fix(a2a): refuse peers on a network-exposed A2A bind with no trusted-peer allow-list (#126756, salvage #130310)","url":null,"state":"merged","close_reason":{"category":"merged","implication":"superseded"},"merged":true,"is_fix_pr":true,"fix_tier":"verified","files_changed":["contributors/emails/[redacted:email]","plugins/platforms/a2a/README.md","plugins/platforms/a2a/adapter.py","plugins/platforms/a2a/security.py","tests/plugins/test_a2a_plugin.py"]}],"trust":{"default_tier":"verified","includes_suggested":false}}