CVE-2026-49973: Hermes WebUI: Unauthenticated Password Takeover via Settings API
Hermes WebUI before 0.51.358 lets unauthenticated remote attackers take over the initial setup and set an arbitrary password during the first-run window, which can lock out the legitimate operator. The record rates it critical, with CVSS 3.1 score 9.4 and CWE-306 (missing authentication for a critical function). CISA KEV does not list it, and no confirmed exploitation appears in the sources consulted.
Overview
Hermes WebUI versions before 0.51.358 contain a missing authentication flaw (CWE-306) in the settings API. According to the record, an unauthenticated remote party can take over the initial setup during the first-run window. VulnCheck published the record as CNA on 2026-06-11.
Impact
- An unauthenticated attacker who can reach the instance during first-run setup may define the administrative password.
- The legitimate operator may be locked out of their own instance.
- The CVSS 3.1 vector in the record indicates network attack vector, low complexity, no privileges required, no user interaction, high confidentiality and integrity impact, and low availability impact.
Affected products and versions
- Product: Nesquena Hermes WebUI.
- Range recorded: before 0.51.358.
- The record has no separate fixed-version field. The patch commit and release reference suggest 0.51.358 is the corrected release (inference).
Exploitation status
- The record shows kev.listed as false, so this CVE is not in the CISA KEV catalog according to the record.
- No confirmed exploitation in the wild appears in the sources consulted.
- The SSVC data in the record lists exploitation as proof-of-concept and automatable as yes. This is a prioritization input, not evidence of observed attacks.
Remediation and mitigation
- Upgrade Hermes WebUI to 0.51.358 or later, as indicated by the patch commit and the related pull request.
- Until the upgrade is done, do not expose first-run setup to untrusted networks, and restrict access to the instance to trusted operators.
- Complete initial setup promptly in a controlled environment, then verify the administrative credentials.
- Before upgrading, check whether instances were reachable from the internet or from shared networks.
Detection guidance
- Review web server or application logs for unexpected requests to the settings endpoint, especially POST requests made before the legitimate operator finished setup.
- Verify whether the administrative account can be accessed with credentials the operator did not set.
- Monitor for new sessions on recently deployed instances.
Limitations of the available information
- The record has source status Deferred and includes no vendor advisory beyond the listed references.
- No fixed-version field is populated in the record.
- The sources do not state exploitation activity, public exploit availability beyond the SSVC value, or the number of affected deployments.
- EPSS values are model estimates and do not confirm exploitation.
Frequently asked questions
What is the core problem in CVE-2026-49973?
According to the record, Hermes WebUI before 0.51.358 lacks authentication on a settings API path during first-run setup, so an unauthenticated remote party may set the administrative password.
Is this vulnerability known to be exploited?
The record shows the CVE is not listed in CISA KEV, and no confirmed exploitation in the wild appears in the sources consulted. The SSVC value in the record is a prioritization input only.
What should operators do now?
Upgrade to 0.51.358 or later, keep first-run setup away from untrusted networks, and check the administrative account and logs for unexpected activity.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.