Is CVE-2026-49973 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49973 being exploited in the wild.

How severe is CVE-2026-49973?

Critical severity, with a CVSS score of 9.4, published 11 June 2026.

Which products and versions are affected?

nesquena Hermes WebUI < 0.51.358.

Is there a fix for CVE-2026-49973?

A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-49973 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-49973?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49973: nesquena Hermes WebUI improper access control in settings API

Q: Is there a fix for CVE-2026-49973?

A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-49973 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-49973?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49973 · Severity: critical · CVSS 9.4 · Published 2026-06-11

Hermes WebUI, a web-based management interface, contains a security flaw in its initial setup process. When the software is first installed and has no password configured, an unauthorized person on the network can remotely set their own password before the legitimate owner does. This allows an attacker to take full control of the interface and lock out the intended administrator.

Quick answers

Is CVE-2026-49973 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49973 being exploited in the wild.
How severe is CVE-2026-49973?: Critical severity, with a CVSS score of 9.4, published 11 June 2026.
Which products and versions are affected?: nesquena Hermes WebUI < 0.51.358.
Is there a fix for CVE-2026-49973?: A patch was published on 2026-06-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-49973 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-49973?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An improper access control vulnerability exists in the `POST /api/settings` endpoint of Hermes WebUI. When the application is in its initial "no-password" state, the settings API remains reachable without authentication to facilitate setup. However, the endpoint failed to restrict the `_set_password` parameter to local or private network origins. An unauthenticated remote attacker can submit a password hash to this endpoint, which persists the new credentials, establishes ownership, and issues a valid session cookie to the attacker. This effectively locks out the legitimate administrator. The vulnerability is resolved in version 0.51.358 by gating first-run password bootstrap to loopback/private networks unless explicitly overridden by the `HERMES_WEBUI_ONBOARDING_OPEN` environment variable.

Affected products

nesquena Hermes WebUI < 0.51.358

Timeline

2026-06-10: patched: Fix committed to repository
2026-06-11: advisory: NVD and vendor advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.