CVE-2026-58123 affects Hermes WebUI before version 0.51.788 and involves missing authentication on critical terminal API endpoints. Attackers can remotely execute arbitrary shell commands without credentials by leveraging the embedded terminal interface. The exploit chain involves creating a session, attaching a PTY shell, and writing commands through the terminal input endpoint via four unauthenticated HTTP requests, leading to full command execution with the privileges of the server process user. This vulnerability has a CVSS 4.0 base score of 9.3, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation results in unauthenticated remote code execution on the affected server, allowing attackers to run arbitrary shell commands as the server process user. This compromises the confidentiality, integrity, and availability of the system and potentially the broader network environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Hermes WebUI terminal API endpoints to trusted networks or authenticated users only, if possible. Monitor for unusual activity related to terminal API usage. Avoid exposing the affected versions to untrusted networks.