Medium severity5.5NVD Advisory· Published Aug 30, 2026

CVE-2026-82640

Description

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Browser Use/Web UIllm-create
Range: 2.0.0 - 3.0.0

Patches

Vulnerability mechanics

References

github.com/browser-use/web-ui/blob/v3.0.0/src/webui/webui_manager.pynvd
github.com/browser-use/web-ui/issues/736nvd
www.vulncheck.com/advisories/browser-use-web-ui-2.0.0-through-3.0.0-cleartext-api-key-storagenvd

News mentions

No linked articles in our index yet.

cvss	0.358
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000