Junglewise Threat Intelligence

CVE-2026-55205: nesquena Hermes WebUI resource exhaustion in OAuth onboarding

CVE-2026-55205 · Severity: medium · CVSS 5.3 · Published 2026-06-18

Technologies: Nesquena Hermes WebUI. Vendors: Nesquena.

Executive brief

Hermes WebUI, a management interface for the Hermes platform, is vulnerable to a resource exhaustion attack during its initial setup phase. An unauthenticated attacker can send repeated requests to the onboarding system, forcing the server to create an unlimited number of background tasks and memory entries. This can lead to a complete service outage by consuming all available server memory and processing threads, preventing legitimate users from completing setup or accessing the interface.

Technical details

A resource exhaustion vulnerability exists in the `POST /api/onboarding/oauth/start` endpoint of Hermes WebUI. The root cause is a lack of admission control or "single-flight" logic; the application fails to check if a pending OAuth flow already exists for a specific provider before spawning new background polling workers and daemon threads. An unauthenticated remote attacker can exploit this by sending concurrent or repeated requests, leading to linear growth in memory consumption and thread counts. This can eventually exhaust host resources (DoS) and trigger excessive outbound device-code requests to upstream providers like Anthropic or OpenAI. The issue is fixed in version 0.51.468 by implementing a per-provider lock and reusing existing pending flows.

Affected products

  • nesquena Hermes WebUI < 0.51.468

Timeline

  • 2026-06-11: other: Initial fix proposed in pull request #3970
  • 2026-06-17: patched: Fix merged and released in version 0.51.468
  • 2026-06-18: disclosed: Vulnerability publicly disclosed and CVE assigned

References