CVE-2026-82640: Cleartext Storage of Sensitive Information in browser-use web-ui

The browser-use web-ui product versions 2.0.0 through 3.0.0 store configured large language model (LLM) API keys in cleartext within JSON files located in a temporary settings directory. These files lack encryption and access restrictions, making it possible for an attacker who can read this directory to extract sensitive API keys. The vulnerability is identified as CVE-2026-82640 and has a CVSS 4.0 score of 6.8, indicating a medium severity. There is no indication of known exploits in the wild or vendor-provided patches.

Exposure of LLM API keys in cleartext can lead to unauthorized use of these keys if an attacker gains read access to the temporary settings directory. This may result in abuse of the API service associated with the keys, potentially incurring costs or data leakage depending on the API provider's policies. The vulnerability requires local or limited privileges (low attack vector and privileges required) and no user interaction, but the impact is limited to confidentiality of stored credentials.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the temporary settings directory to trusted users only and consider rotating any exposed API keys. Avoid storing sensitive keys in cleartext and use secure storage mechanisms if possible.