Hermes WebUI CVE-2026-58122

Exploitation requires that the Hermes WebUI instance (version below 0.51.307) be network-reachable by the attacker and that the onboarding endpoints rely on the X-Forwarded-For header for their local-origin restriction, which is the default vulnerable behavior. The specific prerequisite is the ability to send an HTTP request containing a spoofed X-Forwarded-For header with a loopback address (e.g., 127.0.0.1); no credentials, user interaction, or non-default configuration are needed (PR:N/UI:N/AC:L). Limiting factors: exploitation is blocked if a fronting reverse proxy or load balancer sanitizes/overwrites X-Forwarded-For, if the service is bound only to localhost or an isolated network, or if the instance is already upgraded to 0.51.307+. SSRF impact severity further depends on reachable internal targets (e.g., availability of a cloud metadata endpoint at 169.254.169.254).

The signals are consistent and point to a genuine priority. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H) describes trivial, network-reachable, unauthenticated exploitation with high confidentiality and integrity impact, matching the described header-spoof-to-SSRF/credential-overwrite chain; VA:N and SC/SI/SA:N reflect that availability and downstream systems are not directly hit by the base flaw. No EPSS score, KEV listing, or SSVC decision data was provided, so probabilistic exploitation likelihood is unknown; the absence of a KEV entry means there is no confirmed active exploitation, and POC availability is unstated. The main caveat is deployment footprint rather than technical severity: this is an easy-to-exploit, high-impact bug (spoofable header is a well-understood, low-skill technique), so any internet-exposed instance should be treated as high urgency, but the product's apparent niche/hobby footprint likely limits mass exploitation to opportunistic or targeted scanning.

An attacker discovers an internet-reachable Hermes WebUI instance and sends a crafted HTTP request to an onboarding endpoint with the header X-Forwarded-For: 127.0.0.1, defeating the local-origin restriction. They then abuse the SSRF sink to query the cloud metadata endpoint for IAM credentials, overwrite the configured LLM provider API keys with their own, and trigger an OAuth device-code flow to persist an access token in auth.json. No public exploit code is identified at time of analysis, but the technique is trivial to reproduce given AV:N/AC:L/PR:N/UI:N.