CVE-2026-82640 browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
Attackers with local read access can recover cleartext LLM API keys from predictable JSON files in the browser-use web-ui settings directory.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-82640?
CVE-2026-82640 is a medium-severity vulnerability in browser-use web-ui, published on 30 Aug 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.
Weakness: CWE-312
Which versions are affected by CVE-2026-82640?
How do I fix CVE-2026-82640?
No fix has been published for CVE-2026-82640 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-82640 being exploited?
There is no known exploitation of CVE-2026-82640 in the wild and no public exploit code.
Sources
Also known as GHSA-jrjf-ww9v-c67g.