CVE-2026-6830

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-6830

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6830.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-6830

Published

2026-04-21T21:33:28Z

Modified

2026-08-12T03:51:43Z

Severity

4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Nesquena Hermes WebUI Environment Variable Credential Leakage via Profile Switch

Details

nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.

Database specific

{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-459",
        "CWE-668"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/6xxx/CVE-2026-6830.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "PR #351"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}

References

Affected packages

Git / github.com/nesquena/hermes-webui

Affected ranges

Type

GIT

Repo

https://github.com/nesquena/hermes-webui

Events

Introduced

Fixed

88dc8bbe26a6055161d3251b70f5cd3d3c5831b0

Fixed

09bbbfc657c372481f23f377753befcfc2f08d20

Fixed

f6e1612c7e9aab97a0866ca8f3985f1fd99f52f6

Database specific

Show details

{
    "source": "REFERENCES"
}

Affected versions

v0.*

v0.12

v0.16

v0.16.1

v0.16.2

v0.17.1

v0.17.2

v0.17.3

v0.18

v0.18.1

v0.19

v0.20

v0.21

v0.22

v0.23

v0.24

v0.25

v0.26

v0.27

v0.28

v0.28.1

v0.29

v0.30

v0.30.1

v0.30.2

v0.30.3

v0.30.4

v0.31

v0.31.1

v0.31.2

v0.32

v0.33

v0.34

v0.34.1

v0.34.2

v0.34.3

v0.35

v0.35.1

v0.36

v0.36.1

v0.36.2

v0.36.3

v0.37.0

v0.38.0

v0.38.1

v0.38.2

v0.38.3

v0.38.4

v0.38.5

v0.38.6

v0.39.0

v0.39.1

v0.40.0

v0.40.1

v0.40.2

v0.41.0

v0.42.0

v0.42.1

v0.42.2

v0.43.0

v0.43.1

v0.44.0

v0.44.1

v0.45.0

v0.46.0

v0.47.0

v0.47.1

v0.48.0

v0.48.1

v0.48.2

v0.49.0

v0.49.1

v0.49.2

v0.49.3

v0.49.4

v0.50.0

v0.50.1

v0.50.10

v0.50.108

v0.50.109

v0.50.11

v0.50.110

v0.50.111

v0.50.112

v0.50.113

v0.50.114

v0.50.115

v0.50.116

v0.50.117

v0.50.118

v0.50.119

v0.50.12

v0.50.120

v0.50.121

v0.50.122

v0.50.123

v0.50.124

v0.50.125

v0.50.126

v0.50.127

v0.50.128

v0.50.129

v0.50.13

v0.50.130

v0.50.131

v0.50.14

v0.50.15

v0.50.16

v0.50.17

v0.50.18

v0.50.19

v0.50.2

v0.50.20

v0.50.21

v0.50.22

v0.50.23

v0.50.24

v0.50.25

v0.50.26

v0.50.27

v0.50.28

v0.50.29

v0.50.3

v0.50.30

v0.50.31

v0.50.32

v0.50.33

v0.50.34

v0.50.35

v0.50.36

v0.50.37

v0.50.38

v0.50.39

v0.50.4

v0.50.40

v0.50.41

v0.50.42

v0.50.43

v0.50.44

v0.50.45

v0.50.46

v0.50.47

v0.50.48

v0.50.49

v0.50.5

v0.50.50

v0.50.51

v0.50.52

v0.50.53

v0.50.54

v0.50.55

v0.50.56

v0.50.57

v0.50.58

v0.50.59

v0.50.6

v0.50.60

v0.50.61

v0.50.62

v0.50.63

v0.50.64

v0.50.67

v0.50.68

v0.50.69

v0.50.7

v0.50.70

v0.50.71

v0.50.72

v0.50.73

v0.50.74

v0.50.75

v0.50.76

v0.50.8

v0.50.82

v0.50.83

v0.50.84

v0.50.85

v0.50.86

v0.50.87

v0.50.88

v0.50.89

v0.50.9

v0.50.90

v0.50.91

v0.50.92

v0.50.93

v0.50.94

v0.50.95

v0.50.96

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-6830.json"