CVE-2026-58174

Executive Summary

CVE-2026-58174 is a critical authorization bypass vulnerability in Hermes WebUI, a web-based interface for managing and monitoring Hermes sessions. The flaw resides in the /api/session/import handler, where an imported session is persisted with a null profile instead of inheriting the active named profile. Because the application treats a null profile as the default profile for authorization checks, a user on the default profile can export the imported session transcript and use its session identifier to read files from the named profile's workspace. This effectively defeats the application's profile isolation mechanism, allowing unauthorized access to sensitive data. The vulnerability has a CVSS score of 6.5 (Medium) and is classified under CWE-284 (Improper Access Control). No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood at this time.

Supply Chain & Package Security

Hermes WebUI is a standalone application, not distributed via NPM, PyPI, Go, or Ruby registries. Therefore, no supply chain package security considerations apply.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker needs a valid default profile user account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files from the named profile's workspace can be read.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires a valid user account on the default profile, but it allows unauthorized access to files from other profiles, which could contain sensitive configuration data, credentials, or session transcripts.

Deep Dive & Mechanics

The vulnerability arises from a logical flaw in the session import functionality. When a user imports a session via the /api/session/import endpoint, the application validates that the session's workspace belongs to the active named profile. However, when constructing the Session object, the code fails to set the profile attribute, leaving it as null. This null value is then persisted in the database.

The authorization check for profile access is implemented as follows:

• If the session's profile is null, it is treated as belonging to the default profile.
• If the session's profile matches the user's profile, access is granted.
• Otherwise, access is denied.

Because the imported session has a null profile, any user on the default profile can:

1. Export the imported session transcript.
2. Use the session identifier to read files from the named profile's workspace.

This bypasses the intended profile isolation, allowing a default profile user to access data from other profiles.

Vulnerable vs. Patched Code

Vulnerable Code (before 0.51.521):

# /api/session/import handler
def import_session(request):
    data = request.json
    workspace = data.get('workspace')
    # Validate workspace belongs to active named profile
    if not validate_workspace(workspace, request.user.active_profile):
        return error("Invalid workspace")
    # Construct Session object without setting profile
    session = Session(
        id=data.get('id'),
        workspace=workspace,
        # profile is NOT set here
    )
    session.save()
    return success(session)

Patched Code (0.51.521 and later):

# /api/session/import handler
def import_session(request):
    data = request.json
    workspace = data.get('workspace')
    # Validate workspace belongs to active named profile
    if not validate_workspace(workspace, request.user.active_profile):
        return error("Invalid workspace")
    # Construct Session object with profile set to active profile
    session = Session(
        id=data.get('id'),
        workspace=workspace,
        profile=request.user.active_profile  # FIX: Set profile
    )
    session.save()
    return success(session)

The fix ensures that the imported session inherits the active named profile, preventing the null profile bypass.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid user account on the default profile.
• Access to the Hermes WebUI instance (version < 0.51.521).
• A session import request with a workspace belonging to a named profile.

Exploitation Steps:

1. Log in to Hermes WebUI with a default profile user.
2. Craft a POST request to /api/session/import with a JSON body containing a valid session ID and a workspace from a named profile (e.g., {"id": "attacker_session", "workspace": "/named_profile_workspace"}).
3. The server will validate the workspace but persist the session with a null profile.
4. Export the imported session transcript via the /api/session/export endpoint.
5. Use the session identifier from the exported transcript to read files from the named profile's workspace via the /api/session/read endpoint.

Example cURL Commands:

# Step 2: Import session
curl -X POST https://target-hermes/api/session/import \
  -H "Content-Type: application/json" \
  -H "Cookie: session=default_user_session" \
  -d '{"id": "attacker_session", "workspace": "/named_profile_workspace"}'

# Step 4: Export session transcript
curl -X GET https://target-hermes/api/session/export/attacker_session \
  -H "Cookie: session=default_user_session"

# Step 5: Read file from named profile workspace
curl -X GET https://target-hermes/api/session/read/attacker_session?file=config.yaml \
  -H "Cookie: session=default_user_session"

Blue Team

Detection:

• Monitor for unusual session import requests from default profile users.
• Look for sessions with null profile values in the database.
• Alert on access to workspaces that do not match the user's profile.

Hunting Queries:

• Search logs for /api/session/import requests where the profile field is missing or null.
• Identify sessions where the profile attribute is null and the user is on the default profile.

Mitigation:

• Immediately upgrade to Hermes WebUI version 0.51.521 or later.
• If upgrade is not possible, implement a WAF rule to block session import requests that do not include a valid profile parameter.
• Review and restrict default profile user permissions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /api/session/import with a JSON body containing a workspace from a named profile.
  • GET requests to /api/session/export/{session_id} where the session was imported by a default profile user.
  • GET requests to /api/session/read/{session_id}?file={path} where the path is outside the default profile's workspace.

• File System IOCs:

  • Session records in the database with profile set to null.
  • Log entries showing access to workspaces not belonging to the user's profile.

• Behavioral IOCs:

  • A default profile user accessing files from a named profile's workspace.
  • Multiple session import requests from the same user targeting different workspaces.

Detection Engineering

YARA Rule

rule CVE_2026_58174_Hermes_WebUI_Import_Bypass {
    meta:
        description = "Detects session import requests with missing profile field in Hermes WebUI"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-58174"
        severity = "medium"
    strings:
        $json_body = /{"id":\s*"[^"]*",\s*"workspace":\s*"[^"]*"}/
        $endpoint = "/api/session/import"
    condition:
        $endpoint and $json_body
}

Sigma Rule

title: CVE-2026-58174 - Hermes WebUI Session Import Profile Bypass
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects session import requests without a profile field in Hermes WebUI
author: Valters IT
date: 2026-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-58174
logsource:
    category: webserver
    product: hermes_webui
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/session/import'
        cs-uri-query: '*'
    condition: selection
falsepositives:
    - Legitimate session imports from named profile users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-58174 - Hermes WebUI Session Import Profile Bypass"; flow:to_server; content:"POST"; http_method; content:"/api/session/import"; http_uri; content:"{"id\":"; http_client_body; content:""workspace\":"; http_client_body; pcre:"/^{"id":"[^"]*","workspace":"[^"]*"}$/R"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Hermes WebUI to version 0.51.521 or later. This is the only complete fix.
2. Workaround: If upgrade is not possible, implement a WAF rule to block POST requests to /api/session/import that do not include a profile field in the JSON body.
3. Access Control: Review and restrict default profile user permissions. Consider disabling the default profile if not needed.

Long-Term Measures:

• Implement strict input validation and authorization checks for all API endpoints.
• Conduct regular security audits and penetration testing.
• Monitor for similar vulnerabilities in other components.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Enable logging for all session import and export operations.
• Set up alerts for sessions with null profile values.

Valters IT
Securing Digital Frontiers