CVE-2026-82640: browser-use web-ui 2.0.0 through 3.0.0 Cleartext API Key Storage
browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
browser-use web-uito a version that resolves this vulnerability.Fixed in 2.0.0 through 3.0.0 - Compensating control
Because browser-use web-ui (versions 2.0.0 through 3.0.0) writes configured LLM API keys to disk in cleartext with no encryption or access restrictions, restrict read access to the temporary settings directory so attackers cannot read predictably-named JSON files containing provider API keys.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments of browser-use web-ui versions 2.0.0 through 3.0.0 are exposed if LLM API keys are configured and an attacker can read the temporary settings directory.
What does an attacker need to recover an API key?
The attacker needs local read access to the temporary settings directory. The keys are stored in predictably named JSON files in cleartext, so no decryption is required.
How can I determine whether keys may already be exposed?
Check whether an affected browser-use web-ui version wrote configured provider API keys into JSON files in its temporary settings directory, and review which users or processes had read access to that directory.
What can be done if updating is not immediately possible?
Restrict read access to the temporary settings directory and treat any keys stored there as potentially exposed. Rotate configured provider API keys if unauthorized read access may have occurred.