Home

Description

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

PUBLISHED Reserved 2026-04-21 | Published 2026-04-21 | Updated 2026-04-22 | Assigner VulnCheck




MEDIUM: 4.8CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

LOW: 3.3CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Problem types

CWE-668: Exposure of Resource to Wrong Sphere

CWE-459: Incomplete Cleanup

Product status

Default status
unaffected

Any version before PR #351
affected

Credits

Chia Min Jun Lennon finder

References

github.com/...ommit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0 (Patch Commit) patch

github.com/nesquena/hermes-webui/pull/351 (Pull Request)

github.com/nesquena/hermes-webui/releases/tag/v0.50.132 (Release Notes)

github.com/nesquena/hermes-webui/releases/tag/v0.50.12 (Release Notes) third-party-advisory

www.vulncheck.com/...e-credential-leakage-via-profile-switch third-party-advisory

cve.org (CVE-2026-6830)

nvd.nist.gov (CVE-2026-6830)

Download JSON