CVE-2026-58123: fallo crítico en nesquena hermes-webui
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
43Vexday Risk Score
Corrige pronto. Ella tiene exploit funcional público.
ssvc Attendcvss 9.3epss 4.6%
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Productos afectados
nesquena · hermes-webuiCVEs relacionadas — nesquena hermes-webui
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-49959HIGHHermes WebUI < 0.51.311 RCE via Git Configuration InjectionEPSS 0.9%CVE-2026-49955MEDIUMHermes WebUI < 0.51.270 Resource Exhaustion via passkey/optionsEPSS 0.6%CVE-2026-49973CRITICALHermes WebUI < 0.51.358 Unauthenticated Password Takeover via /api/settingsEPSS 0.5%CVE-2026-55205MEDIUMHermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenticated OAuth Flow EndpointEPSS 0.5%CVE-2026-6832HIGHNesquena Hermes WebUI Arbitrary File Deletion via Unvalidated session_idEPSS 0.5%CVE-2026-58174MEDIUMHermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass via Unset Session Profile on ImportEPSS 0.5%