CVE-2026-6830
Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch
- State
- Published
- Severity
- 4.8 Medium
- Published
- Apr 21, 2026
- Updated
- Jul 14, 2026
- Reserved
- Apr 21, 2026
Description
nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 4.8 Medium | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 3.3 Low | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N | VulnCheck |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
hermes-webuinesquena |
|
References
- Patch Commitpatch
- Pull Requestissue-tracking
- Release Notes
- Release Notesthird-party-advisory
- https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switchthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.