CVE-2026-58123 | Hermes WebUI before 0.51.788 contains an unauthenticated rem… | CVSS 9.8 CRITICAL

Description

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Metadata

CVE ID: CVE-2026-58123
State: PUBLISHED
Assigner: VulnCheck
Reserved: 2026-06-29 14:13 UTC
Published: 2026-07-09 21:14 UTC
Last updated: 2026-07-09 21:14 UTC
Primary CWE: CWE-306
Missing Authentication for Critical Function
Vendor / Product: nesquena / hermes-webui
Sources: cve.org · NVD

Severity & Metrics

9.8 CRITICAL CVSS 3.1

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products (1)

Vendor	Product	Platform	Versions
nesquena	hermes-webui	—	0 < 0.51.788

Weakness (CWE)

CWE	Source	Description
CWE-306	cna	Missing Authentication for Critical Function

CVSS scores (2)

Score	Severity	Version	Source	Vector
9.8	CRITICAL	3.1	cna	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
9.3	CRITICAL	4.0	cna	CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

References (4)