# CVE-2026-58123: nesquena Hermes WebUI unauthenticated RCE in terminal API

Source: https://junglewise.ai/threats/cve-2026-58123-nesquena-hermes-webui-unauthenticated-rce-in-terminal-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-58123 · Severity: critical · CVSS 9.8 · Published 2026-07-09

Hermes WebUI, a management interface for workspace environments, contains a critical flaw in its embedded terminal feature. When the software is used without a password (the default configuration) and exposed to a network, an attacker can gain full control over the server by sending a series of web requests. This allows unauthorized individuals to execute arbitrary commands, potentially leading to complete data theft or system takeover.

Technologies: [Nesquena Hermes WebUI](https://junglewise.ai/threats/technologies/hermes-webui). Vendors: [Nesquena](https://junglewise.ai/threats/vendors/nesquena).

## Quick answers

**Is CVE-2026-58123 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-58123 being exploited in the wild.

**How severe is CVE-2026-58123?** Critical severity, with a CVSS score of 9.8, published 9 July 2026.

**Which products and versions are affected?** Nesquena Hermes WebUI < 0.51.788.

**Is there a fix for CVE-2026-58123?** A patch was published on 2026-06-30: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-58123 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-58123?** Check whether you run Nesquena Hermes WebUI at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A missing authentication check (CWE-306) in the embedded terminal API of Hermes WebUI allows unauthenticated remote code execution. The vulnerability exists because the 'check_auth()' function returns True by default when no password or passkey is configured, leaving the terminal endpoints (/api/terminal/start, /api/terminal/input, etc.) accessible to any network caller. An attacker can achieve full command execution as the server process user by making four sequential HTTP requests to initialize a session, attach a PTY shell, and input arbitrary shell commands. The issue is addressed in version 0.51.788 by implementing a local-origin gate that restricts these endpoints to loopback or private network origins when authentication is disabled.

## Affected products

- nesquena Hermes WebUI < 0.51.788

## Timeline

- 2026-06-30: patched: Fix committed to repository
- 2026-07-01: advisory: Release v0.51.788 published
- 2026-07-09: disclosed: CVE-2026-58123 published

## References

- [https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4](https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4)
- [https://github.com/nesquena/hermes-webui/pull/5268](https://github.com/nesquena/hermes-webui/pull/5268)
- [https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788](https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788)
- [https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api](https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api)

## Related threats

- [nesquena Hermes WebUI authorization bypass in session import](https://junglewise.ai/threats/cve-2026-58174-nesquena-hermes-webui-authorization-bypass-in-session-import)
- [nesquena Hermes WebUI authorization bypass in session export endpoint](https://junglewise.ai/threats/cve-2026-55198-nesquena-hermes-webui-authorization-bypass-in-session-export)
- [Hermes WebUI broken access control in /api/session endpoint](https://junglewise.ai/threats/cve-2026-55197-hermes-webui-broken-access-control-in-api-session-endpoint)
- [nesquena Hermes WebUI TOCTOU race condition in git_discard](https://junglewise.ai/threats/cve-2026-49958-nesquena-hermes-webui-toctou-race-condition-in-git-discard)
- [nesquena Hermes WebUI workspace boundary bypass in remote terminal resolution](https://junglewise.ai/threats/cve-2026-49957-nesquena-hermes-webui-workspace-boundary-bypass-in-remote)