by Kastro
Paper/Archive/CVE-2026-58123

CVE-2026-58123

nesquena hermes-webui — Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

EPSS 5%CVSS 9.8
critical.is priorityof 100
48
CVSS 9.8 (CNA)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 91.7.917 × 2018.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Affected

ProductAffectedFixed inSource
hermes-webui< 0.51.7880.51.788CNA

Scores by source

VulnCheck (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
VulnCheck (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refgithub.com/nesquena/hermes-webui/releases/tag/v0.51.788refgithub.com/nesquena/hermes-webui/pull/5268patchgithub.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4writeupvulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api