{"id":"CVE-2026-6830","aliases":[],"cve":{"records":[{"id":"CVE-2026-6830","source":"VulnCheck","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-04-21T21:22:31.635Z","published":"2026-04-21T21:33:28.985Z","modified":"2026-11-08T14:08:14.485Z"}],"publishers":[{"name":"VulnCheck","role":"CNA","organizationId":"83251b91-4cc7-4094-a5c7-464a1b83ea10","modified":"2026-11-08T14:08:14.485Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-04-22T13:43:58.788Z"}],"references":[{"url":"https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0","tags":["patch"],"source":"VulnCheck"},{"url":"https://github.com/nesquena/hermes-webui/pull/351","tags":["issue-tracking","patch"],"source":"VulnCheck"},{"url":"https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132","tags":["release-notes"],"source":"VulnCheck"},{"url":"https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12","tags":["third-party-advisory","release-notes"],"source":"VulnCheck"},{"url":"https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch","tags":["third-party-advisory"],"source":"VulnCheck"}],"weaknesses":[{"id":"CWE-668","description":"CWE-668: Exposure of Resource to Wrong Sphere","source":"VulnCheck"},{"id":"CWE-459","description":"CWE-459: Incomplete Cleanup","source":"VulnCheck"}],"applicability":[{"source":"VulnCheck","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:get-hermes:hermes_web_ui:*:*:*:*:*:*:*:*"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-04-22T13:38:36.367888Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch","titleSource":"VulnCheck","descriptionSource":"VulnCheck","description":"nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.","score":4.8,"severity":"medium","published":"2026-04-21T21:33:28.985Z","modified":"2026-11-08T14:08:14.485Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"nesquena","name":"hermes-webui","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"PR #351","versionType":"git"}],"defaultStatus":"unaffected","cpes":[],"source":"VulnCheck","url":"https://www.cve.org/CVERecord?id=CVE-2026-6830"}],"remediation":[],"references":["https://github.com/nesquena/hermes-webui/commit/88dc8bbe26a6055161d3251b70f5cd3d3c5831b0","https://github.com/nesquena/hermes-webui/pull/351","https://github.com/nesquena/hermes-webui/releases/tag/v0.50.132","https://github.com/nesquena/hermes-webui/releases/tag/v0.50.12","https://www.vulncheck.com/advisories/nesquena-hermes-webui-environment-variable-credential-leakage-via-profile-switch"],"sources":[{"name":"CVE","id":"CVE-2026-6830","modified":"2026-11-08T14:08:14.485Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-6830"}],"assessments":[{"source":"VulnCheck","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","score":4.8},{"source":"VulnCheck","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","score":3.3}],"sourceAffected":[],"observedAt":"2026-11-08T14:30:27.234Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:50:31.991Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-11-08T16:25:31.053Z","attemptedAt":"2026-11-08T16:25:31.053Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-08T16:25:31.053Z","attemptedAt":"2026-11-08T16:25:31.053Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-08T16:25:31.035Z","attemptedAt":"2026-11-08T16:25:31.035Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-08T16:25:31.035Z","attemptedAt":"2026-11-08T16:25:31.035Z"}],"evidence":[{"source":"ENISA EUVD","id":"EUVD-2026-24515","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-24515","modified":"Nov 8, 2026, 2:08:14 PM","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N","checkedAt":"2026-11-08T16:25:31.035Z"},{"source":"FIRST EPSS","id":"CVE-2026-6830","url":"https://www.first.org/epss/","probability":0.00113,"percentile":0.01411,"date":"2026-11-08","checkedAt":"2026-11-08T16:25:31.035Z"},{"source":"GitHub Advisory Database","id":"GHSA-vvfr-g83f-8qcv","url":"https://github.com/advisories/GHSA-vvfr-g83f-8qcv","modified":"2026-04-22T00:31:53Z","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-08T16:25:31.053Z"},{"source":"NVD","id":"CVE-2026-6830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6830","modified":"2026-10-25T23:10:00.167","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","checkedAt":"2026-11-08T16:25:31.053Z"},{"source":"NVD","id":"CVE-2026-6830","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-6830","modified":"2026-10-25T23:10:00.167","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","checkedAt":"2026-11-08T16:25:31.053Z"}],"aiSummary":{"text":"Nesquena Hermes WebUI versions before PR #351 have a vulnerability where switching profiles does not clear environment variables, potentially exposing sensitive secrets. Attackers with access can exploit this to access provider API keys. The weakness is due to incomplete cleanup and exposure of resources to the wrong sphere.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-08T14:51:16.725Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-6830"}]}}