CVE-2026-58122: Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

Vulnerability summary

CVE-2026-58122 is a critical (CVSS 9.3) Use of Less Trusted Source vulnerability in nesquena hermes-webui. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 30% of scored vulnerabilities.

Timeline

1. 09-07-2026
   PublishedVulnerability first disclosed.
2. 14-07-2026
   Last modifiedVulnerability information updated.

Description

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.

• CWE-348Use of Less Trusted SourceThe product has two different sources of the same data or information, but it uses the source that has less support for verification, is less trusted, or is less resistant to attack.