Issue Station
Sign In
Tools hereToolbox

hermes - 💡(How to fix) Fix [Bug]: Gateway auth bypass — unauthorized user messages processed despite "Unauthorized" log [3 pull requests]

Official PRs (…)
ON THIS PAGE

Recommended Tools

×6

Utilities matched from this issue’s tags and category — try them while you read without losing context.

GitHub issue graph ai analysis

Paste a GitHub issue URL. We fetch that issue, discover linked issues from bodies/comments/timeline, collect linked pull requests, and produce a structured English report.

The report is written in English Markdown for sharing and archival.

Helpful · Quick feedback

Loading…

Error Message

Additional Logs / Traceback (optional)

Root Cause

Root Cause Analysis (optional)

Fix Action

Fixed

Code Example

— logs contain sensitive credentials from the security incident.

---
RAW_BUFFERClick to expand / collapse

Bug Description

When TELEGRAM_ALLOWED_USERS is set, unauthorized Telegram users trigger an "Unauthorized user" warning in logs but their messages are still processed by the agent. The auth check logs the violation but does not actually block message processing.

Steps to Reproduce

1. Set TELEGRAM_ALLOWED_USERS to a specific user ID
2. Have a different Telegram user DM the bot
3. Gateway logs "Unauthorized user" warning
4. Message is still processed and agent responds

Expected Behavior

Unauthorized messages should be dropped immediately after the auth check. No agent processing, no response sent back.

Actual Behavior

Unauthorized user's messages are processed by the agent and receive full responses. The agent executes tool calls and returns results to the unauthorized user. The "Unauthorized user" log entry is the only indication of the violation — no blocking occurs.

Affected Component

Gateway (Telegram/Discord/Slack/WhatsApp)

Messaging Platform (if gateway-related)

Telegram

Debug Report

— logs contain sensitive credentials from the security incident.

Operating System

Ubuntu 24.04

Python Version

Python: 3.11.15

Hermes Version

Hermes Agent v0.13.0 (2026.5.7)

Additional Logs / Traceback (optional)

Root Cause Analysis (optional)

No response

Proposed Fix (optional)

No response

Are you willing to submit a PR for this?

  • I'd like to fix this myself and submit a PR

Vote matrix · Quick signals

Works
Did the solution work? Tap to confirm.
Easy Fix
Was it a quick fix?
Time Saver
Did it save you time?
Blocking
Was it severely blocking?
Common Issue
Are others likely hitting this too?
Flaky / Intermittent
Is it intermittent?
Verified / Reproducible
Can you reproduce it reliably?
Loading…
#API routing#API middleware#SSR setup#ISR setup#authentication setup

Still need to ship something?

×6

Another batch ranked right after the header list — different links, same matching logic.

Back to top recommendations

TRENDING

hermes - 💡(How to fix) Fix [Bug]: Gateway auth bypass — unauthorized user messages processed despite "Unauthorized" log [3 pull requests]