Hermes WebUI

Community-maintained web interface for Hermes Agent (nesquena/hermes-webui), providing near-parity with the CLI through a browser: sessions, workspace browser, cron/tasks UI, skills and memory editors, profiles, and themes. Pairs with the hermes-android app (a WebView wrapper) for mobile access. Not officially supported by Nous Research, but the de-facto standard non-terminal surface.

Architecture

• Runs the Hermes agent in-process, reading HERMES_HOME directly — no privilege separation. A WebUI compromise is effectively an agent compromise, inheriting all of the agent’s tools and host credentials.
• Ships an embedded terminal/PTY API by design — the feature that made CVE-2026-58123 a full RCE rather than mere information disclosure.
• State lives under ~/.hermes/webui/ (inside HERMES_HOME); sessions persist as JSON sidecars, not as message rows in Hermes’s state.db. An opt-in bridge (state_sync.py, setting sync_to_insights, default off) mirrors metadata only (session row, token counts, title) — never message content. Downstream tooling that reads state.db (session search, daily-review introspection) therefore cannot see WebUI conversation content.
• Auth is optional and off by default: password, WebAuthn passkeys, or native OIDC. Binds to 127.0.0.1 by default; the project’s remote-access doc leads with Tailscale and SSH tunneling.
• Bootstrap installer detects an existing Hermes install and won’t touch it; creates its own venv.

CVE history (as of 2026-07-22)

CVE	CVSS 4.0	Class	Affected	Fixed
CVE-2026-58123	9.3 Critical	Unauthenticated RCE via embedded terminal API — create session, attach PTY, write commands; four unauthenticated HTTP requests to full shell as the server user (CWE-306)	< 0.51.788	v0.51.788 (2026-07-09)
CVE-2026-58122	—	Auth bypass via spoofed X-Forwarded-For on onboarding endpoints; SSRF to cloud metadata, overwrite LLM provider config/API keys, OAuth device-code token theft	< 0.51.307	v0.51.307
CVE-2026-49973	—	Unauthenticated first-run setup hijack (_set_password to settings API, no origin restriction)	< 0.51.358	v0.51.358
CVE-2026-55196	—	Unauthenticated passkey registration when HERMES_WEBUI_PASSKEY=1 with no existing credentials (CWE-306)	< 0.51.409	v0.51.409
CVE-2026-55198	—	Cross-profile session exfiltration via export endpoint (CWE-639)	< 0.51.443	v0.51.443
CVE-2026-22677	6.0 Medium	Authenticated path traversal in session-import endpoint; crafted workspace value + relative paths in session file API reads any file the process can read (CWE-22)	< 0.51.44	v0.51.44
CVE-2026-6829	5.3 Medium	Authenticated workspace path traversal (/api/session/new, /api/chat/start, etc.) redirecting working context to /etc, /home; read/write via file APIs	< 0.50.34	v0.50.34
CVE-2026-6832	7.2 High	Authenticated arbitrary file deletion via unvalidated session_id in /api/session/delete	—	—
CVE-2026-49959	8.7 High	RCE via git configuration injection	< 0.51.311	v0.51.311

^{1 2 3}

The pattern across advisories: missing authentication on critical functions (CWE-306) and path traversal (CWE-22) recur — consistent with the CSA’s observation that agent-framework network endpoints have not historically been treated with the scrutiny given to internal service endpoints. ⁴

Blast-radius context

The WebUI inherits the full power of the host’s Hermes agent. The April 2026 independent audit of hermes-agent v0.8.0 (@Anic888, GitHub issue #7826) found the framework’s defaults include unrestricted bash -c shell execution, file reads without a deny list, container deployments that silently skip all approval checks, and agent-writable skills that persist across sessions (a prompt-injection persistence vector). A WebUI breach therefore chains into framework-level findings, not just web-app findings. ⁵

Deployment hardening (assessment from 2026-07-21 conversation)

1. Do not expose publicly behind a simple HTTPS proxy + password. The worst CVE was unauthenticated — a login page with an unauthenticated route behind it is no gate — and reverse-proxy basic auth can break the installed PWA’s service-worker update fetches.
2. Prefer Tailscale (bind HERMES_WEBUI_HOST to the tailnet interface) with HERMES_WEBUI_PASSWORD still set — WireGuard E2E, device identity, no public exposure, works from a phone browser. Server-side-only Tailscale avoids multi-VPN client conflicts.
3. SSH tunnel is a solid second: keep the bind at 127.0.0.1, ssh -N -L 8787:127.0.0.1:8787. Unwieldy on mobile.
4. If public exposure is unavoidable: passkey (WebAuthn) or native OIDC — not a shared password.
5. Pin and update frequently. The project moves fast (multiple releases/day) and the critical fixes are recent; a stale install is the main risk. Verify deployed version ≥ v0.51.788.
6. On the Hermes side: keep approval mode on (never --yolo on that host), consider HERMES_WRITE_SAFE_ROOT to fence writes, and a non-local sandbox backend.

Sources

• 2026
• 2026
• 2026 — 9 CVEs in 4 Days: What Hermes Agent Enterprises Must Learn

Related pages

• opc-ua-security — another “secure by design, insecure by configuration/deployment” assessment with a detect/confirm/remediate orientation
• ntlm-relay-attacks — authentication-bypass-adjacent attack patterns in a different protocol family
• institutionally-constrained-technology-adoption — security defaults as an institutional/incentive problem: opt-in hardening (sandbox, write fences, auth) ships off because defaults optimize for adoption friction

Footnotes

1. 2026 ↩

2. 2026 ↩

3. 2026 — 9 CVEs in 4 Days: What Hermes Agent Enterprises Must Learn ↩

4. 2026 — 9 CVEs in 4 Days: What Hermes Agent Enterprises Must Learn ↩

5. 2026 — 9 CVEs in 4 Days: What Hermes Agent Enterprises Must Learn ↩