CVE-2026-58174
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
A vulnerability in Hermes WebUI before version 0.51.521 allows bypassing profile isolation. When importing a session via the /api/session/import handler, the session object is created without setting its profile, resulting in a null profile. Since a null profile is treated as the default profile, a user on the default profile can export the session transcript and use its session identifier to read files from the named profile's workspace.
Risk Assessment
The organization is at risk of profile isolation breach, potentially leading to unauthorized access to files and data stored in another profile's workspace. An attacker with access to the default profile can read sensitive information from the named profile.
Recommendation
Immediately upgrade Hermes WebUI to version 0.51.521 or later, which includes a fix for this vulnerability. Until the update is applied, restrict access to the /api/session/import endpoint and monitor session import activity.
Other vulnerabilities in Hermes WebUI
See all- CVE-2026-55198Medium
Hermes WebUI before 0.51.443 contains an authorization bypass vulnerability in the session export endpoint that allows authenticated users to access sessions from other profiles. The _handle_session_export handler in api/routes.py fails to verify active-profile ownership before serializing session data.
- CVE-2026-55197Medium
Hermes WebUI before 0.51.443 contains a broken access control vulnerability in the /api/session endpoint that allows authenticated users to disclose cross-profile session transcripts. Attackers can bypass profile boundary checks by directly querying session IDs belonging to other profiles.
- CVE-2026-58123Critical
Hermes WebUI before version 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.
- CVE-2026-58122Critical
Hermes WebUI before version 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.
- CVE-2026-55196Critical
Hermes WebUI before 0.51.409 contains an authentication bypass vulnerability in passkey registration endpoints that allows unauthenticated remote attackers to register arbitrary passkeys. When HERMES_WEBUI_PASSKEY=1 is enabled with no existing credentials, POST /api/auth/passkey/register/options and POST /api/auth/passkey/register endpoints are accessible without authentication.
- CVE-2026-49973Critical
Hermes WebUI before version 0.51.358 contains an improper access control vulnerability that allows unauthenticated remote attackers to hijack initial setup by submitting the _set_password parameter to the settings API endpoint without any network origin restriction. Attackers on any reachable network can send a POST request to the settings endpoint during the first-run setup window to persist an arbitrary password hash, obtain a valid session cookie, and lock out the legitimate operator from their own instance.
- CVE-2026-55205Medium
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads.
- CVE-2026-53871High
Hermes WebUI before 0.51.368 contains an authorization bypass vulnerability in the get_profile_cookie() function that accepts unauthenticated profile names from the hermes_profile cookie. An authenticated attacker can forge the hermes_profile cookie value to bypass profile-scoped authorization checks and access sessions, files, and resources across different profiles.
- CVE-2026-49959High
Hermes WebUI before version 0.51.311 contains a remote code execution vulnerability that allows authenticated attackers to execute arbitrary commands by placing malicious executable Git configuration in a workspace repository's .git/config file. Attackers can exploit Git subprocess invocations in api/workspace_git.py through vectors such as core.fsmonitor, protocol.ext.allow, credential.helper, core.askPass, core.gitProxy, or inherited environment variables including GIT_SSH_COMMAND.
- CVE-2026-49958Medium
Hermes WebUI before version 0.51.303 contains a TOCTOU race condition vulnerability in the git_discard function within api/workspace_git.py, allowing attackers to delete files outside the configured workspace boundary by replacing a validated path component with a symlink.
Original NVD description (English source)
Hermes WebUI before 0.51.521 validates the workspace of an imported session under the active named profile but constructs the Session object without setting its profile in the /api/session/import handler, so the imported session is persisted with a null profile. Because a null profile is treated as the default profile by the profile authorization check, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace, defeating the application's profile isolation.