CVE-2026-58122 is an authentication bypass vulnerability in nesquena's Hermes WebUI before version 0.51.307. The flaw arises because the application trusts the X-Forwarded-For header to enforce local-origin IP restrictions on onboarding endpoints. Attackers can supply a spoofed X-Forwarded-For header containing a loopback address, circumventing these restrictions without authentication. Exploitation allows server-side request forgery (SSRF) against internal services including cloud metadata endpoints, modification of large language model (LLM) provider configurations and API keys with attacker-controlled values, and initiation of OAuth device-code flows to acquire persistent access tokens stored in auth.json.

The vulnerability enables unauthenticated remote attackers to bypass IP-based access controls, leading to SSRF attacks on internal services, unauthorized modification of critical configuration and credentials, and potential persistent unauthorized access via OAuth tokens. This can result in significant compromise of internal infrastructure and sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict or validate the X-Forwarded-For header at network or application layers to prevent spoofing of loopback addresses. Monitor for unusual onboarding endpoint access patterns and consider implementing additional authentication or IP validation controls.