Vulnerability · Published Jul 9, 2026 · Assigned by VulnCheck

CVE-2026-58123Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API

Critical 9.8

In plain English

A critical-severity missing authentication in hermes-webui from nesquena. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.6% (higher than 92% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei.

Severity (CVSS 3.1)9.8Critical

Exploit odds (30 days)4.6%top 8.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Nuclei

Official description

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before 0.51.788

Weakness: CWE-306 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Release Notes release-notes
Pull Request issue-tracking
Patch Commit patch
https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api third-party-advisory