CVE-2026-6830
Low · 3.3CVSS
3.3
EPSS
0.2%
Published
Apr 21, 2026
CISA due date
—
The record
nesquena hermes-webui contains an environment variable leakage vulnerability where profile switching does not clear environment variables from the previously active profile before loading the next profile. Attackers or users can exploit additive dotenv reload behavior to access provider API keys and other sensitive secrets from one profile context in another profile, breaking expected security isolation between profiles.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-109276 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains an incomplete cleanup flaw… CWE-459
- CVE-2026-15390 Das U-Boot with CONFIG_IP_DEFRAG=y parameter fails to clear IP reassembly state after… CWE-459
- CVE-2026-88932 multer is a Node.js middleware for handling multipart/form-data uploads. CWE-459
- CVE-2026-87776 compression is a Node.js and Express compression middleware. CWE-459
- CVE-2026-87549 Incomplete cleanup in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-87446 Incomplete cleanup in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-87436 Incomplete cleanup in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote… CWE-459
- CVE-2026-85043 Incomplete cleanup in Network in Google Chrome prior to 152.0.7977.82 allowed a remote… CWE-459