PT-2026-34194 · Nesquena · Hermes-Webui

Published 2026-04-21 · Updated 2026-04-26 · CVE-2026-6830

Positive Technologies (AI Summary)

CVSS v3.1

3.3

Low

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions nesquena hermes-webui (affected versions not specified)

Description An environment variable leakage occurs when switching profiles, as the system fails to clear variables from the previously active profile before loading the next one. This additive dotenv reload behavior allows users or attackers to access provider API keys and other sensitive secrets from one profile context within another, compromising the security isolation between profiles.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-668

CWE-459

Related Identifiers

CVE-2026-6830

Affected Products

Hermes-Webui

References · 7

• https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-6830 · Security Note
• https://github.com/nesquena/hermes-webui/pull/351 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12 · Note
• https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132 · Note
• https://twitter.com/CVEnew/status/2048481091749544204 · Twitter Post
• https://vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch · Note