# NousResearch/hermes-agent · A2A trusted-peer allowlist fail-open security fix

## Open now

- Nothing open on GitHub.

A security issue where the A2A trusted-peer allowlist fails open (permits all peers) when no allowlist is configured on non-loopback network bindings. Multiple related fixes address this by enforcing fail-closed behavior in that scenario.

## TL;DR

- 6 member(s): 0 open issue(s), 1 closed issue(s), 0 open PR(s), 1 merged PR(s), 4 PR(s) closed without merging.
- A fix was merged to main in PR #130516. Verify it addresses your case.
- **Recommended:** read PR #130516 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `resolved` · deciding PR(s): `pr-130516`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_SPANNING`): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
- Pairwise link density `0.33`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Closed / duplicate issues

- #126756: \[Security\] A2A trusted-peer allowlist fails open when no allowlist is configured

## Prior & competing PRs

- **#130516: fix(a2a): refuse peers on a network-exposed A2A bind with no trusted-peer allow-list (#126756, salvage #130310)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `contributors/emails/[redacted:email]`, `plugins/platforms/a2a/README.md`, `plugins/platforms/a2a/adapter.py`, `plugins/platforms/a2a/security.py`, `tests/plugins/test_a2a_plugin.py`
- **#126775: fix(a2a): fail closed when a network-exposed adapter has no trusted-peer allowlist**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `4fb768fcda`, `#130310`, `#130516`
- **#127431: fix(security): fail closed when A2A trusted-peer allowlist is empty (closes #126756)**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `4fb768fcda`, `#127608`, `#130516`
- **#127608: fix(security): fail closed when A2A trusted-peer allowlist is empty on non-loopback bind**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `4fb768fcda`, `#130516`
- **#130310: fix(a2a): fail closed on non-loopback bind with empty trusted-peers allowlist (#126756)**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `4fb768fcda`, `#130516`

## Fix status

- Merged to main in PR #130516 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-10-01`.