CVE-2026-6830 describes an environment variable leakage vulnerability in nesquena hermes-webui (version 0). When switching profiles, the application fails to clear environment variables from the previous profile before loading the next one. This additive dotenv reload behavior enables attackers or users to access sensitive secrets, including provider API keys, from one profile context while operating in another. This breaks the intended security isolation between profiles and exposes sensitive resources to an unintended sphere. The vulnerability has a CVSS 4.0 score of 4.8, reflecting a medium impact with local attack vector and low complexity.

The vulnerability allows unauthorized access to environment variables containing sensitive information such as API keys from one profile while operating in another profile context. This breaks security isolation between profiles and could lead to unauthorized use of credentials or data leakage within the application environment. The impact is limited by the requirement for local access and low privileges, and no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should avoid switching profiles in a way that relies on environment variable isolation or manually clear environment variables between profile switches if possible. Monitor vendor communications for updates on remediation.