CVE-2026-49973: Hermes WebUI Initial Setup Takeover
Critical CVSS (9.4) reachable over network.
| Field | Value |
|---|---|
| CVE ID | CVE-2026-49973 |
| CVSS score | 9.4 (Critical) |
| Attack vector | Remote over network during first-run setup |
| Auth required | None |
| Patch status | Fixed in Hermes WebUI 0.51.358 |
TL;DR - Critical pre-auth takeover in Hermes WebUI before 0.51.358. - Affects first-run setup; upgrade and restrict access immediately. - No confirmed in-the-wild exploitation, but impact is admin lockout.
Vulnerability at a Glance
CVE-2026-49973 is an improper access control flaw in Hermes WebUI that affects versions before 0.51.358. According to the NVD description, an unauthenticated remote attacker can abuse the product’s initial setup flow by submitting the _set_password parameter to the settings API endpoint during the first-run setup window. If successful, the attacker can persist an arbitrary password hash, obtain a valid session cookie, and effectively seize control of the instance before the legitimate administrator completes setup.
For defenders, the key operational point is that this is not a general authenticated privilege escalation or a low-impact information leak. It is a bootstrap takeover issue. That means exposure is tied to deployment timing and network reachability. A freshly deployed instance that is reachable from untrusted networks before initialization is at materially higher risk than a long-running instance that has already completed setup. Even so, teams should not assume safety without verifying version and deployment state, because the vulnerable path is pre-auth and remote.
What This Vulnerability Actually Means
The NVD description attributes the issue to insufficient restriction on the settings API during initial setup. Specifically, Hermes WebUI accepted a password-setting parameter, _set_password, without adequate origin or access controls during the first-run flow. In practice, that means a remote party on any reachable network path could send a crafted POST request before the legitimate operator finishes initialization.
The impact is severe because the vulnerable action is not merely changing a preference or toggling a setting. The attacker can establish authentication material by setting an arbitrary password hash, then receive a valid session cookie and lock out the real administrator. In SMB and self-hosted environments, that can turn an unattended deployment into an externally controlled system almost immediately after exposure. If Hermes WebUI is integrated into administrative workflows or connected services, the blast radius could extend beyond the WebUI itself.
Affected Versions and Fixed Release
The affected version boundary is clear from the available primary-source data: Hermes WebUI before 0.51.358 is vulnerable, and the issue is fixed in 0.51.358. Defenders should interpret that literally. If you are running 0.51.357 or earlier, or if you cannot verify the exact build, you should treat the deployment as vulnerable until proven otherwise.
Because the project is community-maintained and associated with the official GitHub repository nesquena/hermes-webui, patch validation should focus on the actual upstream release you deployed rather than assumptions from package mirrors or container tags. If your environment tracks latest, validate the resolved version explicitly. In the absence of trustworthy inventory data, defenders should assume vulnerable status for any instance known to have been deployed from an older image or package lineage and prioritize immediate verification.
| Product | Affected Versions | Fixed Version |
|---|---|---|
| Hermes WebUI | All versions before 0.51.358 | 0.51.358 |
Severity and Exposure Assessment
The reported CVSS score is 9.4, which places CVE-2026-49973 firmly in critical territory. The exact CVSS vector string was not available in the NVD tool output used for the research note, so it should not be fabricated. Still, the score aligns with what practitioners would expect from a flaw that is remotely reachable, requires no authentication, and can result in administrator takeover.
The practical exposure question is slightly more nuanced than the numeric score. Exploitation depends on the target being in the first-run setup window and the relevant API being reachable from the attacker’s network location. That requirement may reduce the exposure duration on well-run deployments, but it does not reduce the seriousness. In many real environments, new appliances, containers, and self-hosted apps are deployed before network policies are tightened or before initial setup is completed. That creates exactly the sort of short but dangerous exposure window attackers can scan for and exploit.
Exploitation Status
At the time of writing, CISA KEV does not list CVE-2026-49973, so there is no CISA-confirmed evidence of exploitation in the wild. That is important context, but it should not be mistaken for a clean bill of health. KEV absence means there is no CISA catalog confirmation, not that exploitation is impossible or unlikely.
On PoC availability, no verified public proof-of-concept was confirmed from the primary-source materials summarized in the research note. The NVD references include a VulnCheck advisory and upstream GitHub references such as a commit, pull requests, and the fixed release, but the available data here does not verify a public exploit repository. Therefore, the most accurate status is: no confirmed in-the-wild exploitation from CISA KEV, and no verified public PoC from the source set reviewed here. In the absence of public exploit confirmation, defenders should still assume exploitation is straightforward in principle because the described attack path is simple and pre-auth.
Operational Guidance for Admins and SMB Defenders
For IT admins and SMB operators, the biggest mistake would be treating this as “just patch when convenient.” CVE-2026-49973 affects a sensitive moment in the product lifecycle: the first-run trust establishment phase. If an attacker wins that race, they can control the application from the outset. That can be more damaging than a later authenticated bug because the compromise may blend into the normal deployment sequence.
The right defensive pattern is straightforward: inventory Hermes WebUI instances, identify anything before 0.51.358, determine whether those systems were ever exposed during initial setup, and upgrade immediately. If exposure history is unknown, assume the conservative case and perform focused review of setup-time logs, unexpected session creation, and administrator lockout symptoms. Unknowns should drive caution, not delay.
How to Detect Possible Exploitation
Detection should focus on two questions: whether a vulnerable instance was exposed during first-run, and whether the settings API received suspicious unauthenticated requests involving password initialization. Because the published details identify the settings API and the _set_password parameter, those are your strongest observable anchors for log review, reverse proxy telemetry, and network detection.
You should also review any unexplained administrator lockouts or unexpected first-login states on newly deployed Hermes WebUI instances. If a system appeared to complete setup without the expected operator actions, or if an initial password no longer works immediately after deployment, treat that as a potential compromise indicator. The absence of mature product-specific detections is not unusual for newly disclosed CVEs, so defenders should build temporary detections around request paths, methods, and anomalous session issuance.
Technical Notes
A practical first step is to search web server or reverse proxy logs for POST requests to the settings endpoint during initialization, especially from unexpected source IPs. The exact path format was not provided in the source material, so do not overfit on an invented URI. Instead, pivot on known fields if your application logging captures request bodies, parameters, or route names.
Example grep-style triage for logs that include request parameters:
grep -RniE 'POST .*settings|_set_password|Set-Cookie' /var/log/nginx/ /var/log/apache2/ /var/log/hermes/
Example Splunk-style query for suspicious setup activity:
index=web (method=POST AND (uri_path="*settings*" OR request="*settings*"))
(" _set_password" OR "_set_password=" OR "Set-Cookie")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip, host, uri_path, status
| sort - count
If you have network IDS coverage and can inspect HTTP, a simple temporary signature can alert on password-setting attempts to the setup path. Because the exact URI is not fully documented in the source material, keep the match broad and review hits manually.
Example Suricata-style content match:
alert http any any -> $HOME_NET any (
msg:"Possible CVE-2026-49973 exploitation attempt against Hermes WebUI";
flow:to_server,established;
http.method; content:"POST";
http.request_body; content:"_set_password"; nocase;
classtype:web-application-attack;
sid:4997301;
rev:1;
)
Mitigation and Patching
The primary remediation is to upgrade Hermes WebUI to version 0.51.358 or later. That is the only clearly documented fix boundary in the source material. If you operate multiple environments, prioritize internet-exposed and newly deployed instances first, then validate internal or lab systems that may still be running older builds. After upgrading, verify that the deployed artifact actually reports 0.51.358 or newer and that stale containers or sidecar proxies are not still exposing the old application.
If you cannot patch immediately, the most effective workaround is to prevent untrusted network access to the instance during first-run setup. In practice, that means binding the service to localhost during initialization, placing it behind a VPN, restricting source IPs at a firewall or reverse proxy, or completing setup in an isolated management network before broader exposure. Because the flaw specifically concerns initial setup, process discipline matters: do not leave freshly deployed admin tools reachable from shared or public networks before initialization is complete.
Technical Notes
The exact installation method for Hermes WebUI can vary, so there is no single universal upgrade command that can be guaranteed for every environment. Defenders should avoid guessing. Use the command that matches your deployment source and then verify the resulting version.
If you deploy via Git:
cd /opt/hermes-webui
git fetch --tags
git checkout v0.51.358
If you deploy via Docker Compose and your image tags map to upstream releases, pull the fixed tag explicitly rather than latest:
docker compose pull
docker compose up -d
docker ps --format 'table {{.Names}} {{.Image}} {{.Status}}'
If you cannot patch immediately, block external access during setup with a host firewall. Example with UFW allowing only a trusted admin IP to reach the WebUI port:
sudo ufw deny 8000/tcp
sudo ufw allow from 203.0.113.10 to any port 8000 proto tcp
sudo ufw status numbered
Or bind the service to localhost behind a reverse proxy until setup is finished. For example, in a generic service configuration:
listen_address=127.0.0.1
listen_port=8000
If your instance may have been exposed during first-run before patching, assume potential compromise. Rebuild or redeploy if possible, rotate credentials associated with the service, and invalidate active sessions after upgrading.
References
Primary references for this CVE include the NVD record, the official upstream GitHub commit and pull requests associated with the fix, the upstream release for v0.51.358, and the VulnCheck advisory referenced by NVD. These sources establish the vulnerability scope, the affected version range, and the fixed version number without requiring speculation about undocumented implementation details.
- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-49973
- Commit: https://github.com/nesquena/hermes-webui/commit/1126e541325d401538f6a272a9c024c37d47ae08
- Pull request: https://github.com/nesquena/hermes-webui/pull/3964
- Additional pull request: https://github.com/nesquena/hermes-webui/pull/3973
- Release: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.358
- Advisory: https://www.vulncheck.com/advisories/hermes-webui-unauthenticated-password-takeover-via-api-settings
In short: Hermes WebUI versions before 0.51.358 are vulnerable to unauthenticated takeover during initial setup. Upgrade to 0.51.358 immediately, restrict setup exposure, and investigate any suspicious setup-time POST activity involving the settings API or _set_password.
For further reading on related topics, check out our articles on what is interactive application security testing and comparing the best bug bounty platforms for 2026.
This article may contain affiliate links. We earn a commission on qualifying purchases at no extra cost to you.