Cairn
NousResearch/hermes-agent

Dashboard auth bypass when reverse proxy declared

Cluster 93026. Data as of

Nothing open on GitHub. Fix merged in #93456 on 24 Aug 2026. Check it covers your case.

The short answer

0open issues
0open PRs
5items grouped
Known?
Yes. 5 related items grouped here, 1 issue already closed.
Fix event
A fix was merged to main in PR #93456. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this resolved, deciding PR #93456. That is separate from the fix event.
Still open
Nothing open on GitHub.

These items address a scenario where dashboards bound to loopback addresses remain unauthenticated when a public URL is declared, because the auth check does not account for the operator-configured public URL. The members propose or discuss engaging the authentication gate in that case.

Open issues0

No open issues.

Open PRs0

No open pull requests.

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #93394 Short sessions no longer permanently disable auto-compaction (#93022, salvage #93093)

    merged to main

    files: agent/context_compressor.py, contributors/emails/[redacted:email], tests/agent/test_compaction_anti_thrash.py, tests/agent/test_compression_anti_thrash_persistence.py, tests/agent/test_context_compressor_structural_backoff.py, tests/agent/test_context_compressor_summary_continuity.py, tests/run_agent/test_infinite_compaction_loop.py

  • #93398 install.ps1 no longer crashes at line 367 under StrictMode (#93017, salvage #93020)

    merged to main

    files: scripts/install.ps1, tests/test_install_ps1_resolver_strictmode.py

  • #93456 Loopback dashboards behind a declared reverse proxy are no longer unauthenticated (#93026, salvage #72127)

    merged to main

    files: contributors/emails/[email protected], hermes_cli/config_defaults.py, hermes_cli/main.py, hermes_cli/web_server.py, tests/hermes_cli/test_dashboard_auth_gate.py, tests/hermes_cli/test_dashboard_unified_launch.py, tests/hermes_cli/test_web_server_host_header.py, website/docs/reference/environment-variables.md, website/docs/user-guide/features/web-dashboard.md

1 PR closed without merging

From the close comments: merged via another change 1

  • #93097 fix(dashboard): engage the auth gate when a public URL is declared on a loopback bind · merged via another change → fdff700, #72127, #93026, #93456, #93394, #93395, #93398
Closed issues · 1
  • Closed#93026should_require_auth() ignores the operator-declared public_url, leaving loopback-bound dashboards behind a reverse proxy unauthenticated
How this cluster was grouped
  • Link evidence (structural links throughout): every member is connected by structural evidence: shared changed files, or a closing/superseded reference.
  • Pairwise link density 0.40: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Merged PRs
#93394, #93398, #93456
Closed issues
1
Attempts
1 PR closed without merging
Fix link checked
24 Aug 2026

For your agent

The same facts, typed.

cluster/93026.json
cluster/93026.md