CVE-2026-55198 nesquena CVE debrief

Who should care

Users of Hermes WebUI before version 0.51.443 should apply the patch to prevent unauthorized access to session data. This includes operators, platform administrators, vulnerability management teams, and security teams who need to ensure the security and integrity of session data.

Technical summary

The vulnerability exists in the session export endpoint of Hermes WebUI. An authenticated user can exploit this vulnerability to access sessions from other profiles, potentially leading to unauthorized data exfiltration. The issue arises from the lack of verification of active-profile ownership in the _handle_session_export handler. This allows attackers to exfiltrate foreign session transcripts by guessing or knowing session identifiers.

Defensive priority

High

Recommended defensive actions

• Apply the patch to upgrade Hermes WebUI to version 0.51.443 or later
• Restrict access to the session export endpoint
• Monitor for suspicious activity related to session data access
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record was published on 2026-06-17T19:18:13.480Z and was last modified on 2026-06-17T20:21:59.863Z. The NVD entry is currently Deferred. Evidence is limited to CVE and NVD details. Defenders should verify affected product deployments and review official advisories.

Official resources