CVE-2026-6830: Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

Severity: low (CVSS 3.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-04-21 · updated 2026-10-25
Weakness: CWE-459

Description

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

References

https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0
https://github.com/nesquena/hermes-webui/pull/351
https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12
https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132
https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch

Get alerted when CVE-2026-6830 or the next vulnerability affects your stack