---
id: CVE-2026-58123
title: Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
summary: >-
  Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution
  vulnerability that allows remote attackers to execute arbitrary shell commands
  by accessing the embedded terminal API endpoints without credentials.
  Attackers…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-306
vendor: nesquena
product: hermes-webui
affected:
  - hermes-webui < 0.51.788
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-07-10T15:44:09.803153Z'
exploitAvailable: true
published: '2026-07-09'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:06:45.198Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-58123'
references:
  - url: 'https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788'
    label: hermes-webui 0.51.788 Release Notes
  - url: 'https://github.com/nesquena/hermes-webui/pull/5268'
    label: Pull Request
  - url: >-
      https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api
tags:
  - cve.org
  - exploit-available
epss: 0.04649
epssPercentile: 0.91795
exploits:
  nuclei:
    - CVE-2026-58123
  checkedAt: '2026-11-08T14:51:57.334Z'
ingestedAt: '2026-11-08T14:51:22.308Z'
---

## Overview

Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.

## Affected

- `hermes-webui < 0.51.788`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.