CVE-2026-58123 Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
Unauthenticated attackers can execute arbitrary shell commands via the terminal API, leading to full remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-58123?
CVE-2026-58123 is a critical command injection vulnerability in nesquena hermes-webui, published on 9 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.
Weakness: CWE-306
Which versions are affected by CVE-2026-58123?
How do I fix CVE-2026-58123?
No fix has been published for CVE-2026-58123 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2026-58123 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58123 exists.
Public exploit code: 1 Nuclei template.
Sources
Also known as GHSA-ph29-g65g-m574.