CVE-2026-6830

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-6830", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-04-21T21:22:31.635Z", "datePublished": "2026-04-21T21:33:28.985Z", "dateUpdated": "2026-11-08T14:08:14.485Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:14.485Z"}, "datePublic": "2026-04-21T22:00:00.000Z", "title": "Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch", "descriptions": [{"lang": "en", "value": "nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.</p>"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere", "type": "CWE"}, {"lang": "en", "cweId": "CWE-459", "description": "CWE-459: Incomplete Cleanup", "type": "CWE"}]}], "affected": [{"vendor": "nesquena", "product": "hermes-webui", "versions": [{"status": "affected", "version": "0", "lessThan": "PR #351", "versionType": "git"}], "defaultStatus": "unaffected"}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:get-hermes:hermes_web_ui:*:*:*:*:*:*:*:*"}]}]}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "LOCAL", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 4.8, "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"}}, {"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "availabilityImpact": "NONE", "baseSeverity": "LOW", "baseScore": 3.3, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"}}], "references": [{"url": "https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/nesquena/hermes-webui/pull/351", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132", "name": "hermes-webui 0.50.132 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12", "name": "hermes-webui 0.50.12 Release Notes", "tags": ["third-party-advisory", "release-notes"]}, {"url": "https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch", "tags": ["third-party-advisory"]}], "credits": [{"lang": "en", "value": "Chia Min Jun Lennon", "type": "finder"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "Vulnogram 1.0.1"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-22T13:38:36.367888Z", "id": "CVE-2026-6830", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:43:58.788Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-6830", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-22T13:38:36.367888Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-22T13:42:54.855Z"}}], "cna": {"title": "Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "value": "Chia Min Jun Lennon"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 4.8, "Automatable": "NOT_DEFINED", "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.3, "attackVector": "LOCAL", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "nesquena", "product": "hermes-webui", "versions": [{"status": "affected", "version": "0", "lessThan": "PR #351", "versionType": "git"}], "defaultStatus": "unaffected"}], "datePublic": "2026-04-21T22:00:00.000Z", "references": [{"url": "https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0", "name": "Patch Commit", "tags": ["patch"]}, {"url": "https://github.com/nesquena/hermes-webui/pull/351", "name": "Pull Request", "tags": ["issue-tracking", "patch"]}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132", "name": "hermes-webui 0.50.132 Release Notes", "tags": ["release-notes"]}, {"url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12", "name": "hermes-webui 0.50.12 Release Notes", "tags": ["third-party-advisory", "release-notes"]}, {"url": "https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "Vulnogram 1.0.1"}, "descriptions": [{"lang": "en", "value": "nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.", "supportingMedia": [{"type": "text/html", "value": "<p>nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-668", "description": "CWE-668: Exposure of Resource to Wrong Sphere"}, {"lang": "en", "type": "CWE", "cweId": "CWE-459", "description": "CWE-459: Incomplete Cleanup"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:get-hermes:hermes_web_ui:*:*:*:*:*:*:*:*", "vulnerable": true}], "operator": "OR"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-11-08T14:08:14.485Z"}}}, "cveMetadata": {"cveId": "CVE-2026-6830", "state": "PUBLISHED", "dateUpdated": "2026-11-08T14:08:14.485Z", "dateReserved": "2026-04-21T21:22:31.635Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-04-21T21:33:28.985Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "hermes-webui", "vendor": "nesquena", "versions": [{"lessThan": "PR #351", "status": "affected", "version": "0", "versionType": "git"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles."}, {"lang": "es", "value": "nesquena hermes-webui contiene una vulnerabilidad de fuga de variables de entorno donde el cambio de perfil no borra las variables de entorno del perfil previamente activo antes de cargar el siguiente perfil. Los atacantes o usuarios pueden explotar el comportamiento de recarga aditiva de dotenv para acceder a las claves API del proveedor y otros secretos sensibles de un contexto de perfil en otro perfil, rompiendo el aislamiento de seguridad esperado entre perfiles."}], "id": "CVE-2026-6830", "lastModified": "2026-10-25T23:10:00.167", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "NONE", "baseScore": 3.3, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-6830", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-22T13:38:36.367888Z", "version": "2.0.3"}}]}, "published": "2026-04-21T22:16:20.863", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/nesquena/hermes-webui/pull/351"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-459"}, {"lang": "en", "value": "CWE-668"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,PR #351)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "hermes-webui", "source": "cna", "vendor": "nesquena"}, "product": "hermes-webui", "vendor": "nesquena"}], "analysis": {"en": {"generated_at": "2026-04-22T06:20:04.924375+00:00", "value": {"mitigation_remediation": ["Upgrade Hermes\u2011WebUI to v0.50.12 or later, which clears environment variables on profile switch.", "If immediate upgrade is not possible, isolate each profile by ensuring it uses a dedicated .env file and restrict file permissions so that other profiles cannot read them.", "Monitor logs and user activity for unexpected usage of provider API keys that might indicate credential leakage across profiles."], "summary": {"action": "Apply Patch", "impact": "Credential Leakage"}, "threat_synthesis": {"affected_systems": "nesquena hermes\u2011webui. Versions prior to v0.50.12 (including the release tagged v0.50.11 and earlier) are vulnerable. The patch was applied in releases v0.50.12 and later, such as v0.50.132.", "description_and_impact": "The vulnerability allows an attacker or a legitimate user to access sensitive provider API keys that were set in a previously active profile. The Hermes-WebUI environment variable loader does not clear variables from the previous profile before loading the next one, so switching profiles preserves environment state. This additive dotenv reload behavior enables cross\u2011profile leakage of secrets, effectively breaking the security isolation that users expect between separate profile contexts.", "risk_and_exploitability": "The CVSS score of 4.8 indicates moderate severity. EPSS is not available, so current exploitation probability is unknown, but the lack of a KEV listing suggests no known widespread exploitation. The attack can be performed by any user who can switch profiles within the same Hermes\u2011WebUI instance; it does not require remote code execution or elevated privileges, only the ability to load a malicious profile. The compromised credentials could then be used to access downstream services or sensitive data."}}}}, "created": "2026-04-22T04:45:09.345271+00:00", "updated": "2026-04-22T11:44:56.101824+00:00", "vendors": ["nesquena", "nesquena$PRODUCT$hermes-webui"]}