CVE-2026-58122— Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
Possible ATT&CK Techniques 3AI
T1556 · Modify Authentication Process T1110 · Brute Force T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-58122
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing
Source: NVD (National Vulnerability Database)
Vulnerability Description
Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用不可信的源
Source: NVD (National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| nesquena | hermes-webui | 0 ~ 0.51.307 | - |
II. Public POCs for CVE-2026-58122
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
Qwen3.6-35B-A3B · 7057 chars
Pro+ exclusive includes:
Vulnerability reproduction recording (real sandbox build + trigger, exclusive)
In-depth vulnerability mechanism
Trigger conditions & impact
Full executable POC code
Exploit chain & mitigation
POC zip download
100+ AI POC generations per month
III. Intelligence Information for CVE-2026-58122
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-58122 (2)
Vendor Advisories for CVE-2026-58122 (1)
Other References for CVE-2026-58122 (1)
- 🔗 Release v0.51.307 · nesquena/hermes-webui · GitHubrelease-notes
IV. Related Vulnerabilities
Same product: hermes-webui
- CVE-2026-58123
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API - CVE-2026-58174
Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass - CVE-2026-55205
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenti - CVE-2026-55198
Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltr - CVE-2026-55197
Hermes WebUI < 0.51.443 - Broken Access Control in /api/sess
Same vendor: nesquena
- CVE-2026-58123
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API - CVE-2026-58174
Hermes WebUI < 0.51.521 - Cross-Profile Authorization Bypass - CVE-2026-55205
Hermes WebUI < 0.51.468 - Resource Exhaustion via Unauthenti - CVE-2026-55198
Hermes WebUI < 0.51.443 - Cross-Profile Session Data Exfiltr - CVE-2026-55197
Hermes WebUI < 0.51.443 - Broken Access Control in /api/sess
Same weakness: CWE-348
- CVE-2026-59897
Hono: API Gateway v1 adapter can drop a distinct repeated re - CVE-2026-59999
OpenSSH <10.4 禁用转发配置失效漏洞 - CVE-2026-46466
Dell PowerProtect Data Domain 信任管理问题漏洞 - CVE-2026-57942
LibreTranslate - IP Spoofing via X-Forwarded-For Header - CVE-2026-54289
Hono: Lambda@Edge adapter keeps only the last value of a rep
V. Comments for CVE-2026-58122
No comments yet