CVE-2026-58123

Critical · CVSS 9.8

Hermes WebUI — Unauthenticated Remote Code Execution via Terminal API (Missing Authentication for Critical Function)

CVSS: 9.8; nvd
EPSS: —
KEV: No
Class: oss containerizable; CWE-306

Description

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Search profile — drives PoC discovery

Symbols terminal APIPTY shellsessionattach PTYterminal input endpoint/api/terminalcreate sessionshell command executionunauthenticated HTTP requests

Keywords CVE-2026-58123Hermes WebUIhermes-webuiunauthenticated RCEterminal APIPTY shellCWE-306missing authenticationnesquenaremote code executionembedded terminalv0.51.788

Versions: < 0.51.788

References

Status: enriched · ingested 2026-07-15T00:00:20.000Z · profiled 2026-07-15T00:30:20.000Z