CVE-2026-49958: Hermes WebUI Race Condition Vulnerability

CVE-2026-49958 Overview

CVE-2026-49958 is a time-of-check time-of-use (TOCTOU) race condition in Hermes WebUI versions prior to 0.51.303. The flaw resides in the git_discard function within api/workspace_git.py. Attackers can replace a validated path component with a symlink after the safe_resolve_ws() validation step but before the subsequent Path.unlink() or shutil.rmtree() call. This window allows the delete operation to follow the attacker-controlled symlink and remove arbitrary files outside the workspace boundary. The issue is tracked under CWE-367.

Critical Impact
Authenticated local users can delete arbitrary files outside the configured workspace boundary by winning a race between path validation and file deletion.

Affected Products

Hermes WebUI versions before 0.51.303
The git_discard endpoint in api/workspace_git.py
Deployments exposing the Hermes WebUI workspace git API to authenticated users

Discovery Timeline

2026-06-09 - CVE-2026-49958 published to NVD
2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-49958

Vulnerability Analysis

The vulnerability is a classic TOCTOU race condition between path validation and file deletion. Hermes WebUI's git_discard handler first calls safe_resolve_ws() to verify that a target path resides within the configured workspace directory. After validation succeeds, the handler invokes either Path.unlink() for files or shutil.rmtree() for directories. Between these two operations, an attacker with write access to the workspace can replace a previously validated path component with a symbolic link pointing to a location outside the workspace. The deletion call then follows the symlink and removes the external target. The result is arbitrary file or directory deletion under the privileges of the Hermes WebUI process.

Root Cause

The root cause is non-atomic validation and deletion. The safe_resolve_ws() check and the deletion syscall operate on the path string independently rather than on a single resolved file descriptor. Filesystem state can change between the two operations because the validation does not lock the path or use O_NOFOLLOW semantics on the deletion call.

Attack Vector

An authenticated local attacker with workspace write permissions submits a git_discard request targeting a path they control. During the window between validation and deletion, the attacker swaps a directory component for a symlink referencing an external target such as a configuration file or log directory. The deletion call then traverses the symlink and removes the targeted resource.

python

# Patch excerpt from api/workspace_git.py (Hermes WebUI v0.51.303)

import difflib
import os
-import shutil
import subprocess
import tempfile
import threading

Source: GitHub Commit 4580f58

The patch removes the unsafe shutil import path and reworks deletion to avoid following symlinks introduced after validation.

Detection Methods for CVE-2026-49958

Indicators of Compromise

Unexpected deletion of files or directories outside the configured Hermes WebUI workspace path
Symbolic links appearing inside workspace directories that reference paths outside the workspace root
git_discard API calls from authenticated users immediately followed by missing system or configuration files

Detection Strategies

Audit Hermes WebUI access logs for repeated or rapid git_discard requests targeting the same path
Enable filesystem auditing (auditd on Linux) on the Hermes WebUI workspace parent directories to record unlink, rmdir, and symlink syscalls
Compare expected workspace contents against actual filesystem state to identify out-of-workspace deletions

Monitoring Recommendations

Monitor process execution of the Hermes WebUI service for unusual unlink or rmtree activity outside the workspace root
Alert on creation of symbolic links inside workspace directories whose targets resolve outside the workspace boundary
Track integrity of sensitive system files using file integrity monitoring tools and correlate deletions with Hermes WebUI API activity

How to Mitigate CVE-2026-49958

Immediate Actions Required

Upgrade Hermes WebUI to version 0.51.303 or later, which contains the fix in api/workspace_git.py
Restrict access to the Hermes WebUI instance to trusted authenticated users only
Run the Hermes WebUI service under a least-privilege account that cannot delete sensitive system files

Patch Information

The fix is delivered in Hermes WebUI Release v0.51.303 via Pull Request #3702 and Pull Request #3756. The full commit is available at GitHub Commit 4580f58. Additional analysis is published in the VulnCheck Security Advisory.

Workarounds

Disable the git_discard endpoint or block it at a reverse proxy if upgrading is not immediately possible
Mount the Hermes WebUI workspace on a separate filesystem and run the service under a UID that lacks write access to other filesystems
Apply mandatory access control profiles (AppArmor or SELinux) that restrict the Hermes WebUI process from deleting paths outside the workspace directory

bash

# Example AppArmor restriction to confine deletions to the workspace
/opt/hermes-webui/workspace/** rw,
deny /etc/** w,
deny /var/log/** w,
deny /home/** w,