Critical
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
Type: advisorySources: OSV
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-58123
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 18:53 UTC · Revision 1
Source evidence
Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API
core-osv · Original sourcePublished 9 Jul 2026, 21:14 UTC
Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.
osv:CVE-2026-58123
Complete source record
{
"id": "e999fc5e3d57eab6b17584ce2ea4938d642d88d4723300e17a01b91fefc6fae5",
"url": "https://osv.dev/vulnerability/CVE-2026-58123",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Hermes WebUI < 0.51.788 Unauthenticated RCE via Terminal API",
"summary": "Hermes WebUI before 0.51.788 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrary shell commands by accessing the embedded terminal API endpoints without credentials. Attackers can create a session, attach a PTY shell, and write arbitrary commands through the terminal input endpoint to achieve full command execution as the server process user via four sequential unauthenticated HTTP requests.",
"evidence": "osv:CVE-2026-58123",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-58123",
"aliases": [
"CVE-2026-58123"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/nesquena/hermes-webui",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "df20e3f7d8133af8ca70537536244d37379c876f"
},
{
"fixed": "d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "0.51.788"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "df20e3f7d8133af8ca70537536244d37379c876f"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.51.788"
},
{
"range": [
{
"fixed": "d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v0.51.774",
"v0.51.787",
"v0.51.786",
"v0.51.785",
"v0.51.784",
"v0.51.783",
"v0.51.782",
"v0.51.781",
"v0.51.780",
"v0.51.779",
"v0.51.778",
"v0.51.777",
"v0.51.776",
"v0.51.775",
"v0.51.773",
"v0.51.772",
"v0.51.771",
"v0.51.770",
"v0.51.769",
"v0.51.768",
"v0.51.767",
"v0.51.766",
"v0.51.765",
"v0.51.764",
"v0.51.763",
"v0.51.762",
"v0.51.761",
"v0.51.760",
"v0.51.759",
"v0.51.758",
"v0.51.757",
"v0.51.756",
"v0.51.755",
"v0.51.754",
"v0.51.753",
"v0.51.752",
"v0.51.751",
"v0.51.750",
"v0.51.749",
"v0.51.748",
"v0.51.747",
"v0.51.746",
"v0.51.745",
"v0.51.744",
"v0.51.743",
"v0.51.742",
"v0.51.741",
"v0.51.740",
"v0.51.739",
"v0.51.738",
"v0.51.737",
"v0.51.736",
"v0.51.735",
"v0.51.734",
"v0.51.732",
"v0.51.733",
"v0.51.731",
"v0.51.730",
"v0.51.729",
"v0.51.728",
"v0.51.726",
"v0.51.727",
"v0.51.725",
"v0.51.724",
"v0.51.723",
"v0.51.720",
"v0.51.722",
"v0.51.721",
"v0.51.719",
"v0.51.718",
"v0.51.717",
"v0.51.716",
"v0.51.715",
"v0.51.714",
"v0.51.713",
"v0.51.677",
"v0.51.712",
"v0.51.711",
"v0.51.710",
"v0.51.709",
"v0.51.708",
"v0.51.707",
"v0.51.706",
"v0.51.705",
"v0.51.704",
"v0.51.703",
"v0.51.702",
"v0.51.701",
"v0.51.700",
"v0.51.699",
"v0.51.698",
"v0.51.697",
"v0.51.696",
"v0.51.695",
"v0.51.694",
"v0.51.693",
"v0.51.692",
"v0.51.691",
"v0.51.690",
"v0.51.689",
"v0.51.688",
"v0.51.687",
"v0.51.686",
"v0.51.685",
"v0.51.684",
"v0.51.683",
"v0.51.682",
"v0.51.681",
"v0.51.680",
"v0.51.679",
"v0.51.678",
"v0.51.676",
"v0.51.675",
"v0.51.674",
"v0.51.673",
"v0.51.672",
"v0.51.671",
"v0.51.670",
"v0.51.669",
"v0.51.668",
"v0.51.667",
"v0.51.666",
"v0.51.665",
"v0.51.664",
"v0.51.663",
"v0.51.662",
"v0.51.661",
"v0.51.660",
"v0.51.659",
"v0.51.658",
"v0.51.657",
"v0.51.656",
"v0.51.655",
"v0.51.654",
"v0.51.653",
"v0.51.652",
"v0.51.651",
"v0.51.650",
"v0.51.649",
"v0.51.648",
"v0.51.647",
"v0.51.646",
"v0.51.645",
"v0.51.644",
"v0.51.643",
"v0.51.642",
"v0.51.641",
"v0.51.640",
"v0.51.639",
"v0.51.638",
"v0.51.637",
"v0.51.636",
"v0.51.635",
"v0.51.634",
"v0.51.633",
"v0.51.632",
"v0.51.631",
"v0.51.630",
"v0.51.629",
"v0.51.628",
"v0.51.627",
"v0.51.626",
"v0.51.625",
"v0.51.624",
"v0.51.623",
"v0.51.622",
"v0.51.621",
"v0.51.620",
"v0.51.619",
"v0.51.618",
"v0.51.617",
"v0.51.616",
"v0.51.615",
"v0.51.614",
"v0.51.613",
"v0.51.612",
"v0.51.611",
"v0.51.610",
"v0.51.602",
"v0.51.603",
"v0.51.609",
"v0.51.608",
"v0.51.607",
"v0.51.606",
"v0.51.605",
"v0.51.604",
"v0.51.601",
"v0.51.600",
"v0.51.599",
"v0.51.598",
"v0.51.597",
"v0.51.596",
"v0.51.595",
"v0.51.594",
"v0.51.593",
"v0.51.592",
"v0.51.591",
"v0.51.589",
"v0.51.590",
"v0.51.588",
"v0.51.587",
"v0.51.586",
"v0.51.585",
"v0.51.584",
"v0.51.583",
"v0.51.582",
"v0.51.581",
"v0.51.580",
"v0.51.579",
"v0.51.578",
"v0.51.577",
"v0.51.576",
"v0.51.575",
"v0.51.574",
"v0.51.573",
"v0.51.572",
"v0.51.571",
"v0.51.570",
"v0.51.569",
"v0.51.568",
"v0.51.567",
"v0.51.566",
"v0.51.565",
"v0.51.564",
"v0.51.563",
"v0.51.562",
"v0.51.561",
"v0.51.560",
"v0.51.559",
"v0.51.558",
"v0.51.557",
"v0.51.556",
"v0.51.555",
"v0.51.554",
"v0.51.553",
"v0.51.552",
"v0.51.551",
"v0.51.550",
"v0.51.549",
"v0.51.548",
"v0.51.547",
"v0.51.546",
"v0.51.545",
"v0.51.544",
"v0.51.543",
"v0.51.542",
"v0.51.541",
"v0.51.540",
"v0.51.539",
"v0.51.538",
"v0.51.537",
"v0.51.536",
"v0.51.535",
"v0.51.534",
"v0.51.533",
"v0.51.532",
"v0.51.531",
"v0.51.530",
"v0.51.529",
"v0.51.528",
"v0.51.527",
"v0.51.526",
"v0.51.525",
"v0.51.524",
"v0.51.523",
"v0.51.522",
"v0.51.521",
"v0.51.520",
"v0.51.519",
"v0.51.518",
"v0.51.517",
"v0.51.516",
"v0.51.515",
"v0.51.514",
"v0.51.513",
"v0.51.512",
"v0.51.511",
"v0.51.510",
"v0.51.509",
"v0.51.508",
"v0.51.507",
"v0.51.506",
"v0.51.505",
"v0.51.504",
"v0.51.503",
"v0.51.502",
"v0.51.501",
"v0.51.500",
"v0.51.499",
"v0.51.498",
"v0.51.497",
"v0.51.496",
"v0.51.491",
"v0.51.490",
"v0.51.489",
"v0.51.495",
"v0.51.494",
"v0.51.493",
"v0.51.492",
"v0.51.488",
"v0.51.487",
"v0.51.486",
"v0.51.485",
"v0.51.484",
"v0.51.483",
"v0.51.482",
"v0.51.481",
"v0.51.480",
"v0.51.479",
"v0.51.478",
"v0.51.477",
"v0.51.476",
"v0.51.475",
"v0.51.474",
"v0.51.473",
"v0.51.472",
"v0.51.471",
"v0.51.470",
"v0.51.469",
"v0.51.468",
"v0.51.467",
"v0.51.466",
"v0.51.465",
"v0.51.464",
"v0.51.463",
"v0.51.462",
"v0.51.461",
"v0.51.460",
"v0.51.459",
"v0.51.458",
"v0.51.457",
"v0.51.456",
"v0.51.455",
"v0.51.454",
"v0.51.453",
"v0.51.452",
"v0.51.451",
"v0.51.450",
"v0.51.449",
"v0.51.448",
"v0.51.447",
"v0.51.446",
"v0.51.445",
"v0.51.444",
"v0.51.443",
"v0.51.442",
"v0.51.441",
"v0.51.440",
"v0.51.439",
"v0.51.438",
"v0.51.437",
"v0.51.436",
"v0.51.435",
"v0.51.434",
"v0.51.433",
"v0.51.432",
"v0.51.426",
"v0.51.431",
"v0.51.430",
"v0.51.429",
"v0.51.428",
"v0.51.427",
"v0.51.425",
"v0.51.424",
"v0.51.423",
"v0.51.422",
"v0.51.421",
"v0.51.420",
"v0.51.419",
"v0.51.418",
"v0.51.417",
"v0.51.416",
"v0.51.415",
"v0.51.414",
"v0.51.413",
"v0.51.412",
"v0.51.411",
"v0.51.410",
"v0.51.409",
"v0.51.408",
"v0.51.407",
"v0.51.406",
"v0.51.405",
"v0.51.404",
"v0.51.403",
"v0.51.400",
"v0.51.399",
"v0.51.398",
"v0.51.397",
"v0.51.396",
"v0.51.395",
"v0.51.394",
"v0.51.393",
"v0.51.392",
"v0.51.391",
"v0.51.390",
"v0.51.389",
"v0.51.388",
"v0.51.387",
"v0.51.386",
"v0.51.385",
"v0.51.384",
"v0.51.383",
"v0.51.382",
"v0.51.381",
"v0.51.380",
"v0.51.379",
"v0.51.378",
"v0.51.377",
"v0.51.376",
"v0.51.375",
"v0.51.374",
"v0.51.373",
"v0.51.372",
"v0.51.371",
"v0.51.370",
"v0.51.369",
"v0.51.368",
"v0.51.367",
"v0.51.366",
"v0.51.365",
"v0.51.359",
"v0.51.364",
"v0.51.363",
"v0.51.362",
"v0.51.361",
"v0.51.360",
"v0.51.326",
"v0.51.358",
"v0.51.357",
"v0.51.356",
"v0.51.355",
"v0.51.354",
"v0.51.353",
"v0.51.352",
"v0.51.351",
"v0.51.350",
"v0.51.349",
"v0.51.341",
"v0.51.348",
"v0.51.347",
"v0.51.346",
"v0.51.345",
"v0.51.344",
"v0.51.343",
"v0.51.342",
"v0.51.340",
"v0.51.339",
"v0.51.338",
"v0.51.337",
"v0.51.336",
"v0.51.335",
"v0.51.334",
"v0.51.333",
"v0.51.332",
"v0.51.331",
"v0.51.330",
"v0.51.329",
"v0.51.328",
"v0.51.327",
"v0.51.325",
"v0.51.324",
"v0.51.323",
"v0.51.322",
"v0.51.321",
"v0.51.320",
"v0.51.319",
"v0.51.318",
"v0.51.317",
"v0.51.316",
"v0.51.315",
"v0.51.314",
"v0.51.313",
"v0.51.312",
"v0.51.311",
"v0.51.310",
"v0.51.309",
"v0.51.308",
"v0.51.307",
"v0.51.306",
"v0.51.305",
"v0.51.304",
"v0.51.303",
"v0.51.302",
"v0.51.301",
"v0.51.300",
"v0.51.299",
"v0.51.298",
"v0.51.297",
"v0.51.296",
"v0.51.295",
"v0.51.294",
"v0.51.293",
"v0.51.292",
"v0.51.291",
"v0.51.290",
"v0.51.289",
"v0.51.288",
"v0.51.287",
"v0.51.286",
"v0.51.285",
"v0.51.284",
"v0.51.283",
"v0.51.282",
"v0.51.281",
"v0.51.280",
"v0.51.279",
"v0.51.278",
"v0.51.277",
"v0.51.276",
"v0.51.275",
"v0.51.274",
"v0.51.273",
"v0.51.272",
"v0.51.271",
"v0.51.270",
"v0.51.269",
"v0.51.268",
"v0.51.267",
"v0.51.266",
"v0.51.265",
"v0.51.264",
"v0.51.263",
"v0.51.262",
"v0.51.261",
"v0.51.260",
"v0.51.259",
"v0.51.258",
"v0.51.257",
"v0.51.256",
"v0.51.255",
"v0.51.254",
"v0.51.253",
"v0.51.252",
"v0.51.251",
"v0.51.250",
"v0.51.249",
"v0.51.248",
"v0.51.247",
"v0.51.246",
"v0.51.245",
"v0.51.244",
"v0.51.243",
"v0.51.242",
"v0.51.241",
"v0.51.240",
"v0.51.239",
"v0.51.238",
"v0.51.237",
"v0.51.236",
"v0.51.235",
"v0.51.234",
"v0.51.233",
"v0.51.232",
"v0.51.231",
"v0.51.230",
"v0.51.229",
"v0.51.228",
"v0.51.227",
"v0.51.226",
"v0.51.225",
"v0.51.224",
"v0.51.223",
"v0.51.222",
"v0.51.221",
"v0.51.220",
"v0.51.219",
"v0.51.218",
"v0.51.217",
"v0.51.216",
"v0.51.215",
"v0.51.214",
"v0.51.213",
"v0.51.212",
"v0.51.211",
"v0.51.210",
"v0.51.209",
"v0.51.208",
"v0.51.207",
"v0.51.206",
"v0.51.205",
"v0.51.204",
"v0.51.203",
"v0.51.202",
"v0.51.201",
"v0.51.200",
"v0.51.199",
"v0.51.198",
"v0.51.197",
"v0.51.196",
"v0.51.195",
"v0.51.194",
"v0.51.193",
"v0.51.192",
"v0.51.191",
"v0.51.190",
"v0.51.189",
"v0.51.188",
"v0.51.187",
"v0.51.186",
"v0.51.185",
"v0.51.184",
"v0.51.182",
"v0.51.157",
"v0.51.183",
"v0.51.181",
"v0.51.180",
"v0.51.179",
"v0.51.178",
"v0.51.177",
"v0.51.176",
"v0.51.175",
"v0.51.174",
"v0.51.173",
"v0.51.172",
"v0.51.171",
"v0.51.169",
"v0.51.170",
"v0.51.168",
"v0.51.167",
"v0.51.166",
"v0.51.165",
"v0.51.164",
"v0.51.163",
"v0.51.162",
"v0.51.161",
"v0.51.160",
"v0.51.159",
"v0.51.158",
"v0.51.156",
"v0.51.155",
"v0.51.154",
"v0.51.153",
"v0.51.152",
"v0.51.145",
"v0.51.151",
"v0.51.150",
"v0.51.149",
"v0.51.148",
"v0.51.147",
"v0.51.146",
"v0.51.141",
"v0.51.144",
"v0.51.143",
"v0.51.142",
"v0.51.139",
"v0.51.140",
"v0.51.138",
"v0.51.137",
"v0.51.136",
"v0.51.135",
"v0.51.134",
"v0.51.133",
"v0.51.132",
"v0.51.131",
"v0.51.130",
"v0.51.129",
"v0.51.128",
"v0.51.127",
"v0.51.126",
"v0.51.125",
"v0.51.124",
"v0.51.123",
"v0.51.122",
"v0.51.121",
"v0.51.120",
"v0.51.119",
"v0.51.118",
"v0.51.117",
"v0.51.116",
"v0.51.115",
"v0.51.114",
"v0.51.113",
"v0.51.112",
"v0.51.111",
"v0.51.110",
"v0.51.109",
"v0.51.108",
"v0.51.107",
"v0.51.106",
"v0.51.105",
"v0.51.104",
"v0.51.103",
"v0.51.102",
"v0.51.101",
"v0.51.100",
"v0.51.99",
"v0.51.98",
"v0.51.97",
"v0.51.96",
"v0.51.95",
"v0.51.94",
"v0.51.93",
"v0.51.92",
"v0.51.91",
"v0.51.90",
"v0.51.89",
"v0.51.88",
"v0.51.87",
"v0.51.86",
"v0.51.85",
"v0.51.84",
"v0.51.83",
"v0.51.82",
"v0.51.61",
"v0.51.81",
"v0.51.80",
"v0.51.79",
"v0.51.78",
"v0.51.77",
"v0.51.76",
"v0.51.75",
"v0.51.74",
"v0.51.73",
"v0.51.72",
"v0.51.71",
"v0.51.70",
"v0.51.69",
"v0.51.68",
"v0.51.67",
"v0.51.66",
"v0.51.65",
"v0.51.64",
"v0.51.63",
"v0.51.62",
"v0.51.60",
"v0.51.59",
"v0.51.58",
"v0.51.57",
"v0.51.54",
"v0.51.56",
"v0.51.55",
"v0.51.52",
"v0.51.53",
"v0.51.50",
"v0.51.51",
"v0.51.34",
"v0.51.49",
"v0.51.48",
"v0.51.47",
"v0.51.46",
"v0.51.45",
"v0.50.278",
"v0.51.44",
"v0.51.43",
"v0.51.42",
"v0.51.41",
"v0.51.40",
"v0.51.39",
"v0.51.38",
"v0.51.37",
"v0.51.36",
"v0.51.35",
"v0.51.31",
"v0.51.33",
"v0.51.32",
"v0.51.30",
"v0.51.29",
"v0.51.28",
"v0.51.27",
"v0.51.26",
"v0.51.25",
"v0.51.24",
"v0.51.23",
"v0.51.22",
"v0.51.21",
"v0.51.20",
"v0.51.19",
"v0.51.18",
"v0.51.17",
"v0.51.16",
"v0.51.15",
"v0.51.14",
"v0.51.13",
"v0.51.12",
"v0.51.11",
"v0.51.10",
"v0.51.9",
"v0.51.8",
"v0.51.7",
"v0.51.6",
"v0.51.5",
"v0.51.4",
"v0.51.3",
"v0.51.2",
"v0.51.1",
"v0.51.0",
"v0.50.297",
"v0.50.296",
"v0.50.295",
"v0.50.294",
"v0.50.293",
"v0.50.292",
"v0.50.291",
"v0.50.290",
"v0.50.289",
"v0.50.288",
"v0.50.287",
"v0.50.286",
"v0.50.285",
"v0.50.284",
"v0.50.283",
"v0.50.282",
"v0.50.281",
"v0.50.280",
"v0.50.279",
"v0.50.277",
"v0.50.276",
"v0.50.275",
"v0.50.274",
"v0.50.273",
"v0.50.272",
"v0.50.271",
"v0.50.270",
"v0.50.269",
"v0.50.268",
"v0.50.267",
"v0.50.266",
"v0.50.265",
"v0.50.263",
"v0.50.264",
"v0.50.261",
"v0.50.262",
"v0.50.260",
"v0.50.259",
"v0.50.258",
"v0.50.257",
"v0.50.256",
"v0.50.255",
"v0.50.254",
"v0.50.253",
"v0.50.252",
"v0.50.251",
"v0.50.250",
"v0.50.249",
"v0.50.248",
"v0.50.247",
"v0.50.246",
"v0.50.245",
"v0.50.244",
"v0.50.243",
"v0.50.242",
"v0.50.241",
"v0.50.240",
"v0.50.239",
"v0.50.238",
"v0.50.237",
"v0.50.236",
"v0.50.235",
"v0.50.233",
"v0.50.232",
"v0.50.231",
"v0.50.230",
"v0.50.229",
"v0.50.228",
"v0.50.227",
"v0.50.226",
"v0.50.225",
"v0.50.224",
"v0.50.223",
"v0.50.222",
"v0.50.221",
"v0.50.220",
"v0.50.219",
"v0.50.218",
"v0.50.217",
"v0.50.216",
"v0.50.215",
"v0.50.214",
"v0.50.212",
"v0.50.211",
"v0.50.210",
"v0.50.209",
"v0.50.208",
"v0.50.207",
"v0.50.206",
"v0.50.205",
"v0.50.204",
"v0.50.203",
"v0.50.202",
"v0.50.200",
"v0.50.199",
"v0.50.198",
"v0.50.197",
"v0.50.196",
"v0.50.195",
"v0.50.194",
"v0.50.193",
"v0.50.192",
"v0.50.191",
"v0.50.190",
"v0.50.189",
"v0.50.188",
"v0.50.187",
"v0.50.186",
"v0.50.185",
"v0.50.184",
"v0.50.183",
"v0.50.182",
"v0.50.181",
"v0.50.180",
"v0.50.179",
"v0.50.178",
"v0.50.177",
"v0.50.176",
"v0.50.175",
"v0.50.174",
"v0.50.173",
"v0.50.172",
"v0.50.171",
"v0.50.170",
"v0.50.169",
"v0.50.168",
"v0.50.167",
"v0.50.166",
"v0.50.165",
"v0.50.164",
"v0.50.163",
"v0.50.162",
"v0.50.161",
"v0.50.160",
"v0.50.159",
"v0.50.158",
"v0.50.157",
"v0.50.156",
"v0.50.150",
"v0.50.147",
"v0.50.146",
"v0.50.145",
"v0.50.144",
"v0.50.143",
"v0.50.142",
"v0.50.141",
"v0.50.140",
"v0.50.139",
"v0.50.138",
"v0.50.137",
"v0.50.136",
"v0.50.135",
"v0.50.134",
"v0.50.133",
"v0.50.132",
"v0.50.131",
"v0.50.130",
"v0.50.129",
"v0.50.128",
"v0.50.127",
"v0.50.126",
"v0.50.125",
"v0.50.124",
"v0.50.123",
"v0.50.122",
"v0.50.121",
"v0.50.120",
"v0.50.119",
"v0.50.118",
"v0.50.117",
"v0.50.116",
"v0.50.115",
"v0.50.114",
"v0.50.113",
"v0.50.112",
"v0.50.111",
"v0.50.110",
"v0.50.109",
"v0.50.108",
"v0.50.96",
"v0.50.95",
"v0.50.94",
"v0.50.93",
"v0.50.92",
"v0.50.91",
"v0.50.90",
"v0.50.89",
"v0.50.88",
"v0.50.87",
"v0.50.86",
"v0.50.85",
"v0.50.84",
"v0.50.83",
"v0.50.82",
"v0.50.76",
"v0.50.75",
"v0.50.74",
"v0.50.73",
"v0.50.72",
"v0.50.71",
"v0.50.70",
"v0.50.69",
"v0.50.68",
"v0.50.67",
"v0.50.64",
"v0.50.63",
"v0.50.62",
"v0.50.61",
"v0.50.60",
"v0.50.59",
"v0.50.58",
"v0.50.57",
"v0.50.56",
"v0.50.55",
"v0.50.54",
"v0.50.53",
"v0.50.52",
"v0.50.51",
"v0.50.50",
"v0.50.49",
"v0.50.48",
"v0.50.47",
"v0.50.46",
"v0.50.45",
"v0.50.44",
"v0.50.43",
"v0.50.42",
"v0.50.41",
"v0.50.40",
"v0.50.39",
"v0.50.38",
"v0.50.37",
"v0.50.36",
"v0.50.35",
"v0.50.34",
"v0.50.33",
"v0.50.32",
"v0.50.31",
"v0.50.30",
"v0.50.29",
"v0.50.28",
"v0.50.27",
"v0.50.26",
"v0.50.25",
"v0.50.24",
"v0.50.23",
"v0.50.22",
"v0.50.21",
"v0.50.20",
"v0.50.19",
"v0.50.18",
"v0.50.17",
"v0.50.16",
"v0.50.15",
"v0.50.14",
"v0.50.13",
"v0.50.12",
"v0.50.11",
"v0.50.10",
"v0.50.9",
"v0.50.8",
"v0.50.7",
"v0.50.6",
"v0.50.5",
"v0.50.4",
"v0.50.3",
"v0.50.2",
"v0.50.1",
"v0.50.0",
"v0.49.4",
"v0.49.3",
"v0.49.2",
"v0.49.1",
"v0.49.0",
"v0.48.2",
"v0.48.1",
"v0.48.0",
"v0.47.1",
"v0.47.0",
"v0.46.0",
"v0.45.0",
"v0.44.1",
"v0.44.0",
"v0.43.1",
"v0.43.0",
"v0.42.2",
"v0.42.1",
"v0.42.0",
"v0.41.0",
"v0.40.2",
"v0.40.1",
"v0.40.0",
"v0.39.1",
"v0.39.0",
"v0.38.6",
"v0.38.5",
"v0.38.4",
"v0.38.3",
"v0.38.2",
"v0.38.1",
"v0.38.0",
"v0.37.0",
"v0.36.3",
"v0.36.2",
"v0.36.1",
"v0.36",
"v0.35.1",
"v0.35",
"v0.34.3",
"v0.34.2",
"v0.34.1",
"v0.34",
"v0.33",
"v0.32",
"v0.31.2",
"v0.31.1",
"v0.31",
"v0.30.4",
"v0.30.3",
"v0.30.2",
"v0.30.1",
"v0.30",
"v0.29",
"v0.28.1",
"v0.28",
"v0.27",
"v0.26",
"v0.25",
"v0.24",
"v0.23",
"v0.22",
"v0.21",
"v0.20",
"v0.19",
"v0.18.1",
"v0.18",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.16.2",
"v0.16.1",
"v0.16",
"v0.12"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-58123.json"
}
}
],
"modified": "2026-10-28T02:30:22.422274797Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58123.json",
"https://github.com/nesquena/hermes-webui/releases/tag/v0.51.788",
"https://nvd.nist.gov/vuln/detail/CVE-2026-58123",
"https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-rce-via-terminal-api",
"https://github.com/nesquena/hermes-webui/pull/5268",
"https://github.com/nesquena/hermes-webui/commit/d257e5f36cfa9328600c8bde6f0de09a6ad9b6f4",
"https://github.com/nesquena/hermes-webui"
],
"provider_metadata": {
"cwe_ids": [
"CWE-306"
],
"cna_assigner": "VulnCheck",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/58xxx/CVE-2026-58123.json"
}
},
"related_cves": [
{
"value": "CVE-2026-58123",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 488815,
"published_at": "2026-07-09T21:14:06.078+00:00"
}