Security readout for executives and security teams
Plain-English summary
Hermes WebUI before 0.51.788 lets remote attackers use terminal API endpoints without logging in. If the WebUI is reachable, an attacker could run shell commands as the server process user, creating serious risk to the host, data, and service availability.
Executive priority
Prioritize immediate remediation for any exposed Hermes WebUI deployment. This is a critical unauthenticated remote command execution issue, so a reachable vulnerable instance can become a full server compromise path.
Technical view
The vulnerability is CWE-306: missing authentication for embedded terminal API endpoints. The CVSS 3.1 score is 9.8, with network access, low complexity, no privileges, and no user interaction. Sources describe arbitrary shell command execution through unauthenticated terminal session, PTY attachment, and input requests.
Likely exposure
Exposure is likely limited to organizations running nesquena/hermes-webui versions before 0.51.788. Highest risk applies where the WebUI is Internet-accessible or reachable from untrusted networks. The source bundle does not provide CPEs or broader product-family impact.
Exploitation context
The advisory describes unauthenticated RCE using four sequential HTTP requests to terminal API endpoints. KEV is false, and the provided sources do not cite active exploitation. The bug is still urgent because exploitation requires network reachability and no credentials.
Researcher notes
Evidence supports missing authentication on terminal API functionality before 0.51.788. The source bundle names the fixed release, pull request, patch commit, and third-party advisory, but does not provide confirmed exploitation, CPE coverage, or environment-specific blast-radius details.
Mitigation direction
- Upgrade Hermes WebUI to v0.51.788 or later using vendor release guidance.
- Restrict WebUI access to trusted networks until the upgrade is verified.
- Block unauthenticated access paths to terminal API endpoints where feasible.
- Review host logs for unexpected terminal sessions or shell activity.
- Monitor vendor and VulnCheck advisories for follow-up guidance.
Validation and detection
- Inventory Hermes WebUI deployments and record running versions.
- Treat any version before 0.51.788 as vulnerable.
- Confirm v0.51.788 or the referenced patch commit is deployed.
- Check whether WebUI is reachable from the Internet or untrusted networks.
- Review access logs for unexpected terminal API requests.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-306: Credential and account abuse lookup
Authentication and credential weaknesses can make valid-account abuse and credential telemetry useful review starting points. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2026-58123 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
2 official scoresWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9VulnCheckCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N——VulnCheckVulnerability scoring details
Base CVSS 4.0 score
9.3CriticalVector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- Release NotesCVE reference, VulnCheck · release-notes
- Pull RequestCVE reference, VulnCheck · issue-tracking
- Patch CommitCVE reference, VulnCheck · patch
- https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-apiCVE reference, VulnCheck · third-party-advisory
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Missing Authentication for Critical Function
Missing Authentication for Critical Function represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.