{"vulnerability": "cve-2026-58122", "sightings": [{"uuid": "0bbed9ad-ff2d-4028-80d6-a762ad0b8b74", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58122", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqamhqf4fl2z", "content": "CVE-2026-58122 - hermes-webui\nA security flaw in Hermes WebUI before version 0.51.307 allows unauthorized users to access internal services, potentially leading to data exposure or unauthorized actions.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#hermeswebui #nesquena #CVE #infosec", "creation_timestamp": "2026-07-09T21:50:06.449129Z"}, {"uuid": "7b09b196-aa91-4e02-a951-76e6c481d6fa", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58122", "type": "seen", "source": "https://bsky.app/profile/cve.skyfleet.blue/post/3mqaqdeat3r27", "content": "CVE-2026-58122 - Hermes WebUI\nCVE ID : CVE-2026-58122\n \n Published : July 9, 2026, 10:17 p.m. | 15\u00a0minutes ago\n \n Description : Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin ...", "creation_timestamp": "2026-07-09T22:59:14.622417Z"}, {"uuid": "2a18bbae-3517-490b-a7b8-f2fdc9e9eed1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-58122", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mqaqi2e7ny2a", "content": "\ud83d\udd34 CVE-2026-58122 - Critical (9.1)\n\nHermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthen...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-58122/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-07-09T23:01:52.526854Z"}, {"uuid": "184d2532-7ba0-4428-aa70-35d34bcbd0be", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-58122", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mqatr5udao2f", "content": "Hermes WebUI <0.51.307 hit by CRITICAL auth bypass (CVE-2026-58122): Spoofed X-Forwarded-For enables SSRF & config overwrite. Restrict/validate headers & monitor onboarding endpoints. https://radar.offseq.com/threat/cve-2026-58122-use-of-less-trusted-source-in-nesqu-c1a99cec42d28f9e #OffSeq #CVE2...", "creation_timestamp": "2026-07-10T00:00:39.135831Z"}, {"uuid": "bf34523b-789a-468c-9faf-a3db7c519beb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-58122", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/116892738294124832", "content": "CVE-2026-58122 (CRITICAL): Hermes WebUI <0.51.307 lets remote attackers bypass local IP restrictions via spoofed X-Forwarded-For \u2014 enabling SSRF, config overwrite, and OAuth token theft. Restrict header spoofing & monitor access. https://radar.offseq.com/threat/cve-2026-58122-use-of-less-trusted-source-in-nesqu-c1a99cec42d28f9e #OffSeq #CVE202658122 #infosec #SSRF", "creation_timestamp": "2026-07-10T00:00:37.931201Z"}]}