Which versions of Hermes WebUI are affected by CVE-2026-58123?

Hermes WebUI versions prior to 0.51.788 contain a critical unauthenticated remote code execution vulnerability (CVE-2026-58123, CVSS 9.3) that permits attackers to execute arbitrary shell commands…. A patch is available.

How to fix or mitigate CVE-2026-58123?

Within 24 hours: Inventory all Hermes WebUI deployments and identify versions prior to 0.51.788; isolate externally accessible instances pending remediation. Within 7 days: Deploy vendor patch to version 0.51.788 or later across all affected systems; prioritize production and internet-facing instances. Within 30 days: Verify patch deployment across all systems using version detection; review access logs for exploitation attempts.

Hermes WebUI CVE-2026-58123

Q: What is the CVSS score of CVE-2026-58123?

CVE-2026-58123 has a CVSS 4.0 base score of 9.3 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.9%.

EUVD-2026-42722 CRITICAL

Missing Authentication for Critical Function (CWE-306)

2026-07-09 VulnCheck

GHSA-ph29-g65g-m574

Authentication Bypass RCE Hermes Webui Nesquena

9.3

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

9.3 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Missing authentication on network terminal endpoints gives unauthenticated low-complexity RCE (AV:N/AC:L/PR:N/UI:N); full OS command execution yields C:H/I:H/A:H, no scope change.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 09, 2026 - 22:06 vuln.today

DescriptionCVE.org

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

AnalysisAI

Unauthenticated remote code execution in Hermes WebUI before version 0.51.788 lets remote attackers run arbitrary shell commands by reaching the product's embedded terminal API without any credentials. Because of a missing authentication check (CWE-306), an attacker chains four sequential unauthenticated HTTP requests to create a session, attach a PTY shell, and inject commands, executing code as the server process user. Reported by VulnCheck with a CVSS 4.0 base score of 9.3; a vendor patch is available and no public exploit code has been identified at time of analysis.

Technical ContextAI

Hermes WebUI (GitHub project nesquena/hermes-webui, per CPE cpe:2.3:a:nesquena:hermes-webui) exposes a browser-based interface that includes an embedded terminal feature backed by a pseudo-terminal (PTY) shell. The vulnerability is a CWE-306 Missing Authentication for a Critical Function: the terminal API endpoints that create sessions, attach a PTY, and accept terminal input do not enforce any authentication or authorization. Because the PTY writes attacker-supplied input directly to an interactive shell, arbitrary command input on the input endpoint is executed by the operating system shell running under the web server's process identity, turning an unauthenticated web request into direct OS command execution.

RemediationAI

Vendor-released patch: v0.51.788 - upgrade Hermes WebUI to 0.51.788 or later, which is the primary and authoritative fix (release: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788, patch commit d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4, PR 5268). Until the upgrade is applied, remove any internet exposure by placing the WebUI behind a VPN or firewall and restricting network access to the terminal API endpoints to trusted management hosts only; if the embedded terminal feature is not required, disable it or block the terminal session/attach/input endpoints at a reverse proxy, and add an authenticating proxy (for example enforcing HTTP auth or SSO in front of the application) so that unauthenticated requests cannot reach the PTY endpoints. The trade-off of these controls is loss of remote terminal convenience and added proxy/network complexity, and they do not fully remediate the missing-authentication root cause, so treat them only as interim measures pending the upgrade. Refer to the VulnCheck advisory at https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api for details.