CRITICALVulnerability
Verified
Global

NVD CRITICAL: CVE-2026-58122 — Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability tha...

·Source: NIST NVD

Updated:

Executive Summary

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overw

Analysis

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json. CVSS Score: 9.1. Published: 2026-07-09T22:17:09.363.

Indicators of Compromise (1)

CVE (1)
CVE-2026-58122
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jul 9, 2026. Verified by: NIST.

Related Threats

MEDIUMVulnerabilityNEW

CaixaBank builds public benches out of recycled bank cards

CaixaBank has embarked on a novel recycling project, turning old bank cards into benches that will sit in villages where the lender's mobile branches visit.

Finextra
MEDIUMVulnerabilityNEW

European Parliament backs digital euro, paving way for final negotiations

The European Parliament has voted in favour of the creation of a digital euro, paving the way for the final stage of negotiations with EU state members on the makeup of the CBDC ahead of a potential 2029 launch.

Finextra
MEDIUMVulnerabilityNEW

Why Post-Quantum Migration Might Be Bigger Than It Looks

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/post-quantum-migration-might-be-bigger-than-looks-image_small-9-a-32191.jpg" align=right hspace=4><b>Experts Detail Migration Scope, Timelines and Governance Gaps in Going Quantum-Safe</b><br>Migrating to post-quantum cryptography isn't a weekend patch. It's one of the largest transformations an enterprise will undertake, and it w

Bank Info Security