CVEvulnerability
CVE-2026-6830
4.8 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-04-21
- Last modified
- 2026-10-25
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 4.8 MEDIUM — CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 3.3 LOW — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-459, CWE-668
Description
nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.
Related
References
- https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0 github.com
- https://github.com/nesquena/hermes-webui/pull/351 github.com
- https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12 github.com
- https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 github.com
- https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch www.vulncheck.com