The vulnerability in nesquena hermes-webui arises from improper handling of environment variables during profile switching. Specifically, the environment variables from the previously active profile remain set and are not cleared before loading the next profile. Due to the additive behavior of dotenv reloads, this leads to leakage of sensitive information like API keys across profile boundaries, violating expected isolation and potentially exposing secrets to unauthorized profiles.

An attacker or user with access to multiple profiles can gain unauthorized access to environment variables containing sensitive secrets from other profiles. This exposure can lead to compromise of provider API keys and other confidential data, undermining the security model that assumes profile isolation. The CVSS 4.8 score reflects a medium impact with local attack vector and low complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid switching profiles in a way that relies on environment variable isolation or manually clear environment variables between profile switches to prevent leakage.