CVE-2026-58122 is an authentication bypass vulnerability in nesquena's Hermes WebUI prior to version 0.51.307. The flaw arises because the application trusts the X-Forwarded-For header to enforce local-origin IP restrictions on onboarding endpoints. Attackers can supply a spoofed header containing a loopback address to circumvent these restrictions without authentication. Exploitation allows server-side request forgery targeting internal services including cloud metadata endpoints, modification of large language model provider configurations and API keys with attacker-controlled values, and initiation of OAuth device-code flows to obtain persistent access tokens stored in auth.json.

The vulnerability allows unauthenticated remote attackers to bypass IP-based access controls, leading to server-side request forgery against internal network services, unauthorized modification of sensitive configuration and API keys, and unauthorized acquisition of persistent authentication tokens. This can result in significant compromise of the affected system and its integrations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected onboarding endpoints, validate and sanitize the X-Forwarded-For header properly, and monitor for suspicious requests that attempt to spoof local IP addresses.