Hermes WebUI Authentication Bypass via X-Forwarded-For Spoofing (SSRF and API Key Takeover)

Technical Analysis

The vulnerability (CVE-2026-58122) stems from improper trust of client-supplied X-Forwarded-For headers when enforcing loopback/local-origin restrictions on onboarding endpoints, allowing attackers to spoof a loopback address (e.g., 127.0.0.1) and bypass what should be a network-layer access control. Once bypassed, attackers can trigger SSRF against internal services, including cloud metadata endpoints (e.g., AWS IMDS at 169.254.169.254), potentially exfiltrating instance credentials. More critically, attackers can overwrite LLM provider configuration and API keys stored by the application, redirecting agent/model traffic to attacker-controlled endpoints, and can initiate OAuth device-code flows to obtain long-lived access tokens persisted in auth.json for continued unauthorized access. This is a pre-authentication, remotely exploitable flaw requiring no user interaction, making it highly attractive for automated scanning and exploitation. Because Hermes WebUI is a frontend commonly used to manage LLM provider credentials and agent configurations, successful exploitation directly compromises AI agent pipelines by allowing attackers to hijack API keys, reroute model calls to malicious endpoints, exfiltrate cloud credentials via SSRF, and maintain persistent access through stolen OAuth tokens.

Affected Systems

Hermes WebUI versions prior to 0.51.307; deployments exposing onboarding endpoints to untrusted networks or reverse proxies that do not strip/validate client-supplied X-Forwarded-For headers; installations storing LLM provider API keys and OAuth tokens in auth.json.

Indicators of Compromise

• auth.json (target file for token theft and configuration overwrite)
• Header pattern: X-Forwarded-For: 127.0.0.1 (or other loopback/local addresses)
• Unexpected outbound requests to 169.254.169.254 (cloud metadata endpoint)
• Unauthorized modifications to LLM provider configuration settings
• Unexpected OAuth device-code authorization requests originating from onboarding endpoints

Remediation Steps

1. 1

   Upgrade Hermes WebUI

   Update all Hermes WebUI instances to version 0.51.307 or later, which addresses the header-spoofing authentication bypass.

2. 2

   Enforce proper header validation

   Configure reverse proxies and load balancers to strip or overwrite client-supplied X-Forwarded-For headers before forwarding requests, ensuring only trusted infrastructure can set this header.

3. 3

   Restrict network exposure

   Ensure onboarding endpoints and administrative interfaces are not exposed to the public internet; restrict access via network segmentation, VPN, or allow-listing.

4. 4

   Rotate credentials

   Immediately rotate all LLM provider API keys and OAuth tokens stored in auth.json, and audit for unauthorized configuration changes or token issuance.

5. 5

   Block metadata endpoint access

   Implement network-level controls (e.g., IMDSv2 enforcement, firewall rules) to prevent SSRF requests from reaching cloud metadata services.

6. 6

   Monitor and audit logs

   Review access logs for anomalous X-Forwarded-For headers, unexpected onboarding endpoint access, and unusual OAuth device-code flow initiations.