Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-58122 Details

ANALYZED

This CVE record has been analyzed and enriched by NVDAPI.com as an independent party.

Description

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.

Metrics

CVSS 3.x Severity and Vector Strings:

VolerionCVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

CNA: [email protected]CVSS-B:9.1 CRITICALVector:CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/nesquena/hermes-webui/commit/70596e6993be0d4cee083c1c1a86f5e7ad5d57b7	[email protected]	Source CodeVendor
https://github.com/nesquena/hermes-webui/pull/3758	[email protected]	Issue TrackingVendor
https://github.com/nesquena/hermes-webui/releases/tag/v0.51.307	[email protected]	Release NotesVendor
https://www.vulncheck.com/advisories/hermes-webui-authentication-bypass-via-x-forwarded-for-header-spoofing	[email protected]	AdvisoryRemedy

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-348	Use of Less Trusted Source	[email protected]

Affected Products

Product	Versions
Hermes WebUI	< 0.51.307 (semver)
CPE No CPEs found in CPE dictionary for this product. Remediation Upgrade: 0.51.307moderate efforthttps://github.com/nesquena/hermes-webui/releases/tag/v0.51.307 Workaround:low effort Set the environment variable HERMES_WEBUI_TRUST_FORWARDED_FOR=1 behind a trusted reverse proxy to allow the use of forwarded IP headers.

Change History

3 change records found show changes

Date	Action	Recorded By
Jul 14, 2026	CVE Modified	[email protected]
Jul 10, 2026	CVE Modified	CISA-ADP
Jul 9, 2026	New CVE Received	[email protected]