VulnerabilityDeferred

CVE-2026-82640

Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

MEDIUM 6.8EPSS 0.06%

Does this matter?

Lower severity and a low EPSS score (0.06%). Track it; it rarely justifies an emergency change on its own.

Description

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

CVSS 4.0: 6.8 MEDIUMCVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
EPSS: 0.06% probability · 0th percentile
CISA KEV: Not listed
Weakness: CWE-312
Source: disclosure@vulncheck.com

References

https://github.com/browser-use/web-ui
https://github.com/browser-use/web-ui/blob/v3.0.0/src/webui/webui_manager.py
https://github.com/browser-use/web-ui/issues/736
https://www.vulncheck.com/advisories/browser-use-web-ui-2.0.0-through-3.0.0-cleartext-api-key-storage

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.