Skip to content
Threat Feed
Subscribe

Vendor

Hermes

1 brief RSS
critical advisory

CVE-2026-58122: Hermes WebUI Authentication Bypass via Spoofed X-Forwarded-For Header

CVE-2026-58122 describes an authentication bypass vulnerability in Hermes WebUI before version 0.51.307, allowing unauthenticated remote attackers to bypass local-origin IP restrictions on onboarding endpoints by spoofing the X-Forwarded-For header with a loopback address, leading to server-side request forgery (SSRF), API key overwrites, and persistent access token acquisition.

Hermes WebUI < 0.51.307 authentication-bypass ssrf web-vulnerability credential-theft persistence cloud network
1r 4t 1c