Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

Published 6 mo ago 2026-04-21 · modified 12 d ago 2026-10-25 · JSON

CVSS

3.3

v3.1 · CNA

CISA KEV

not known exploited

EPSS

0.1%

percentile 1%

Public exploits

none known

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 6 mo ago 2026-04-22

Exploit prediction (EPSS)

0.11% probability of exploitation in the next 30 days, higher than 1% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
CNA	4.0	4.8	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N`
CNA	3.1	3.3	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`
CNA	4.0	4.8	`CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X`
CNA	3.1	3.3	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N`

Affected products

nesquena hermes-webui

Classification

Weakness

CWE-668 Exposure of Resource to Wrong Sphere
CWE-459 Incomplete Cleanup

References

github.com /nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0 · patch
github.com /nesquena/hermes-webui/pull/351 · issue-tracking
github.com /nesquena/hermes-webui/releases/tag/v0.50.132
github.com /nesquena/hermes-webui/releases/tag/v0.50.12 · third-party-advisory
vulncheck.com /advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-swit · third-party-advisory

Sources

CVE List: CVE-2026-6830
NVD: CVE-2026-6830

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary