CVE-2026-82640

MediumCVSS 5.5

Published: 30/08/2026(UTC)Updated: 10/09/2026(UTC)Translated: 30/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.06%

0th percentile - higher than 0% of all known CVEs

Summary

In browser-use web-ui versions 2.0.0 through 3.0.0, configured LLM API keys are written to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

Risk Assessment

Risk of API key theft, potentially leading to unauthorized use of LLM services and financial costs.

Recommendation

Store API keys in a secure vault and restrict access to temporary directories.

Other vulnerabilities in browser-use web-ui

CVE-2026-82637Medium
In browser-use web-ui versions 2.0.0 through 3.0.0, browser settings paths are not validated in run_agent_task, allowing attackers to create directories at arbitrary locations by supplying absolute paths to save_recording_path, save_trace_path, save_agent_history_path, or save_download_path parameters. Attackers can exploit this via the unauthenticated Gradio interface to create directories anywhere the root-running container has write access.

Original NVD description (English source)

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS