CVE-2026-58122
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
Hermes WebUI before version 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.
Risk Assessment
The risk to the organization includes unauthorized access to sensitive internal data and services, potential takeover of language model configurations, and theft of access tokens, which could lead to breaches of confidentiality and system integrity.
Recommendation
It is recommended to immediately upgrade Hermes WebUI to version 0.51.307 or later and implement validation of the X-Forwarded-For header to reject loopback addresses from external sources.
Original NVD description (English source)
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.