CVE-2026-55197 nesquena CVE debrief

Who should care

Defenders responsible for Hermes WebUI deployments should assess exposure and prioritize remediation to prevent unauthorized session transcript disclosure. This includes verifying the version of Hermes WebUI and restricting access to the /api/session endpoint. Additionally, defenders should review official advisories and monitor for suspicious activity related to session transcript disclosure.

Why it matters

CVE-2026-55197 is a high-severity vulnerability in Hermes WebUI that allows authenticated users to disclose cross-profile session transcripts. Defenders should prioritize verifying exposure and remediating vulnerable instances to prevent unauthorized access to sensitive information.

• Potential disclosure of unauthorized conversation transcripts and metadata.
• Possible bypass of profile boundary checks.
• Required verification of Hermes WebUI instances for exposure to unauthorized session transcript disclosure.
• Need for restricted access to the /api/session endpoint.

Technical summary

The /api/session endpoint in Hermes WebUI before 0.51.443 contains a broken access control vulnerability that allows authenticated users to disclose cross-profile session transcripts by directly querying session IDs belonging to other profiles. This vulnerability enables attackers to bypass profile boundary checks and retrieve unauthorized conversation transcripts and metadata. The vulnerability has a CVSS score of 7.1 and is classified as HIGH severity. Defenders should prioritize verifying exposure and remediating vulnerable instances to prevent unauthorized access to sensitive information.

Defensive priority

Defenders should prioritize verifying exposure of Hermes WebUI instances to unauthorized session transcript disclosure via the /api/session endpoint.

Recommended defensive actions

• Verify Hermes WebUI instances for exposure to unauthorized session transcript disclosure via the /api/session endpoint.
• Restrict access to the /api/session endpoint to prevent unauthorized session ID queries.
• Upgrade Hermes WebUI to version 0.51.443 or later to address the broken access control vulnerability.
• Monitor for suspicious activity related to session transcript disclosure.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record and NVD entry provide details on the broken access control vulnerability in Hermes WebUI before 0.51.443, allowing authenticated users to disclose cross-profile session transcripts. Evidence is limited to public CVE and NVD sources. Defenders should verify exposure and review official advisories for additional details. The vulnerability is confirmed to exist in versions prior to 0.51.443, but specific exploit details are not provided.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.