What’s Vulnerable › Vulnerabilities

CVE-2026-58123: Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 4.6% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-07-09 · updated 2026-10-25
• Weakness: CWE-306

Description

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Affected products

• nesquena hermes-webui: before 0.51.788 — fixed in 0.51.788

How to fix

Upgrade to a fixed version: nesquena hermes-webui 0.51.788. Check the vendor advisory for mitigations.

References

• https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4
• https://github.com/nesquena/hermes-webui/pull/5268
• https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788
• https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api

Get alerted when CVE-2026-58123 or the next vulnerability affects your stack