Is CVE-2026-55205 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55205 being exploited in the wild.

How severe is CVE-2026-55205?

Medium severity, with a CVSS score of 5.3, published 18 June 2026.

Which products and versions are affected?

nesquena Hermes WebUI < 0.51.468.

Is there a fix for CVE-2026-55205?

A patch was published on 2026-06-17: Fix merged and released in version 0.51.468 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55205 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-55205?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55205: nesquena Hermes WebUI resource exhaustion in OAuth onboarding

Q: Is there a fix for CVE-2026-55205?

A patch was published on 2026-06-17: Fix merged and released in version 0.51.468 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-55205 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-55205?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55205 · Severity: medium · CVSS 5.3 · Published 2026-06-18

Hermes WebUI, a management interface for the Hermes platform, is vulnerable to a resource exhaustion attack during its initial setup phase. An unauthenticated attacker can send repeated requests to the onboarding system, forcing the server to create an unlimited number of background tasks and memory entries. This can lead to a complete service outage by consuming all available server memory and processing threads, preventing legitimate users from completing setup or accessing the interface.

Quick answers

Is CVE-2026-55205 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55205 being exploited in the wild.
How severe is CVE-2026-55205?: Medium severity, with a CVSS score of 5.3, published 18 June 2026.
Which products and versions are affected?: nesquena Hermes WebUI < 0.51.468.
Is there a fix for CVE-2026-55205?: A patch was published on 2026-06-17: Fix merged and released in version 0.51.468 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55205 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-55205?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A resource exhaustion vulnerability exists in the `POST /api/onboarding/oauth/start` endpoint of Hermes WebUI. The root cause is a lack of admission control or "single-flight" logic; the application fails to check if a pending OAuth flow already exists for a specific provider before spawning new background polling workers and daemon threads. An unauthenticated remote attacker can exploit this by sending concurrent or repeated requests, leading to linear growth in memory consumption and thread counts. This can eventually exhaust host resources (DoS) and trigger excessive outbound device-code requests to upstream providers like Anthropic or OpenAI. The issue is fixed in version 0.51.468 by implementing a per-provider lock and reusing existing pending flows.

Affected products

nesquena Hermes WebUI < 0.51.468

Timeline

2026-06-11: other: Initial fix proposed in pull request #3970
2026-06-17: patched: Fix merged and released in version 0.51.468
2026-06-18: disclosed: Vulnerability publicly disclosed and CVE assigned

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.