CVE-2026-58123 affects nesquena's Hermes WebUI before version 0.51.788. The vulnerability arises from missing authentication on critical terminal API endpoints, enabling unauthenticated remote attackers to execute arbitrary shell commands on the server. Attackers can create a session, attach a pseudo-terminal shell, and write commands through the terminal input endpoint without credentials, achieving full command execution as the server process user. The CVSS 4.0 base score is 9.3, indicating a critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows remote attackers to execute arbitrary shell commands on the affected server with the privileges of the server process user. This can lead to full system compromise, data theft, service disruption, or further lateral movement within the network. The vulnerability does not require authentication, making it highly accessible to attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict network access to the Hermes WebUI terminal API endpoints to trusted users only, and monitor for suspicious HTTP requests targeting these endpoints. Do not expose the affected versions to untrusted networks.