Cairn
NousResearch/hermes-agent

Webhook INSECURE_NO_AUTH security hardening discussion

Cluster 6264 · gateway. Data as of

Nothing open on GitHub. Fix attempted, not merged.

The short answer

0open issues
0open PRs
5items grouped
Known?
Yes. 5 related items grouped here, 2 issues already closed.
Fix event
No fix has been merged to main. 3 PRs closed without merging; see the attempts below.
Tracker
The maintainers' tracker marks this unresolved. That is separate from the fix event.
Still open
Nothing open on GitHub.

These issues and pull requests concern a reported unauthenticated remote code execution risk tied to a webhook authentication bypass mode (INSECURE_NO_AUTH), with proposed mitigations including explicit opt-in requirements, config-based controls, and restrictions on non-loopback bindings.

Open issues0

No open issues.

Open PRs0

No open pull requests.

3 PRs closed without merging

From the close comments: superseded by another PR 1 · other 2

  • #6445 fix(webhook): require explicit opt-in for INSECURE_NO_AUTH to prevent unintended RCE · superseded by another PR → #47347
  • #19333 fix: remove INSECURE_NO_AUTH webhook authentication bypass · other
  • #47347 fix(webhook): move INSECURE_NO_AUTH opt-in to config.yaml allow_insecure key · other
Closed issues · 2
  • Closed#6264[Security] Remove Insecure Auth Bypass Mode
  • Closed#6440[Bug]: Unauthenticated Remote Code Execution via Webhook INSECURE_NO_AUTH
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.34: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
gateway
Closed issues
2
Attempts
3 PRs closed without merging

For your agent

The same facts, typed.

cluster/6264.json
cluster/6264.md