Vulnerability · Published Apr 21, 2026 · Assigned by VulnCheck

CVE-2026-6830Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

Low 3.3

In plain English

A low-severity security flaw in hermes-webui from nesquena. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 1% of all known vulnerabilities).

Severity (CVSS 3.1)3.3Low

Exploit odds (30 days)0.1%top 98.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

Affected products (as reported)

Vendor	Product	Versions
nesquena	hermes-webui	0 – before PR #351

Weakness: CWE-668, CWE-459 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

References

Patch Commit patch
Pull Request issue-tracking
Release Notes
Release Notes third-party-advisory
https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch third-party-advisory