nesquena hermes-webui up to 0.51.306 Onboarding Endpoint auth.json X-Forwarded-For server-side request forgery

Summaryinfo

A vulnerability, which was classified as critical, was found in nesquena hermes-webui up to 0.51.306. The affected element is an unknown function of the file auth.json of the component Onboarding Endpoint. Such manipulation of the argument X-Forwarded-For leads to server-side request forgery. This vulnerability is uniquely identified as CVE-2026-58122. The attack can be launched remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, has been found in nesquena hermes-webui up to 0.51.306. Affected by this issue is some unknown functionality of the file auth.json of the component Onboarding Endpoint. The manipulation of the argument X-Forwarded-For with an unknown input leads to a server-side request forgery vulnerability. Using CWE to declare the problem leads to CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to perform server-side request forgery against internal services including cloud metadata endpoints, overwrite LLM provider configuration and API keys with attacker-controlled values, or initiate OAuth device-code flows to obtain persistent access tokens stored in auth.json.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2026-58122 since 06/29/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

By approaching the search of inurl:auth.json it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 0.51.307 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• nesquena

Name

• hermes-webui

Version

• 0.51.306

Website

• Product: https://github.com/nesquena/hermes-webui/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion