hermes-webui CVE-2026-6830

Exploitation requires local access to a running hermes-webui process and sufficient privilege to invoke the profile-switching function (CVSS PR:L). The leakage condition only arises when at least two profiles are configured and the source profile defines one or more secrets (e.g., OPENAI_API_KEY, CUSTOM_TOKEN) in its .env file that are absent from the destination profile's .env. In single-profile deployments or where all profiles share identical credential sets, no cross-profile leakage can occur. The attack is not automatable over the network (SSVC: Automatable=no; CVSS AV:L) and cannot be triggered remotely. Exploitation is further limited to the confidentiality of secrets stored in profile .env files - it does not enable code execution, privilege escalation, or modification of data.

The CVSS 4.0 score of 4.8 (Medium) reflects a local attack vector (AV:L), low complexity (AC:L), low-privilege requirement (PR:L), and limited confidentiality impact (VC:L) with no integrity or availability impact. These signals are internally consistent and align with the described exploitation conditions. EPSS at 0.01% (2nd percentile) and SSVC Exploitation=none both indicate no observed active exploitation or exploit tooling at time of analysis, and SSVC Automatable=no confirms the attack cannot be scripted for mass targeting. The vulnerability is absent from CISA KEV. Real-world risk is bounded by two factors: exploitation requires local access plus permission to invoke profile switching, and the impact is limited to cross-profile credential disclosure rather than system compromise. The primary risk scenario is insider threat or a compromised local account in a shared hermes-webui deployment where multiple profiles contain distinct high-value API keys. For single-user or single-profile deployments, the vulnerability has no exploitable surface.

A user with local access to a shared hermes-webui instance first activates a profile that defines OPENAI_API_KEY=secret-from-p1 in its .env, then switches to a second profile whose .env does not define that key. Because the prior _reload_dotenv applied dotenv additively, OPENAI_API_KEY remains live in os.environ and is accessible to any code or user operating in the second profile context, allowing the actor to read and exfiltrate the first profile's API key. No public exploit code exists for this vulnerability.