Environment Variable Leakage in nesquena hermes-webui Affects User Profile Security

CVE-2026-6830

What is CVE-2026-6830?

The nesquena hermes-webui application features a vulnerability that allows environment variable leakage during profile switching. When users switch profiles, the application fails to clear the environment variables from the previously active profile, enabling the potential for attackers or unwarranted users to access sensitive information, such as API keys and other credentials from different profiles. This issue compromises the expected security isolation between user profiles and necessitates immediate remediation to protect sensitive data.

References