What is CVE-2026-82640?

CVE-2026-82640 is a medium-severity vulnerability in Browser-Use Web-Ui, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.5/10. Published 2026-08-30.

How severe is CVE-2026-82640?

Medium severity. CVSS v3 base score is 5.5 out of 10.

Vulnerability in Browser-Use Web-Ui

CVE-2026-82640

browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption or access restrictions. Attackers with read access to the temporary settings directory can recover provider API keys from predictably-named JSON files.

CVSS v3 metric

CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Browser-use Web-ui

Weakness classification (CWE)

CWE-312 — Cleartext Storage of Sensitive Information

References

disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (product)
disclosure@vulncheck.com (technical-description)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-82640?: CVE-2026-82640 is a medium-severity vulnerability in Browser-Use Web-Ui, classified under Cleartext Storage of Sensitive Information. CVSS score: 5.5/10. Published 2026-08-30.
How severe is CVE-2026-82640?: Medium severity. CVSS v3 base score is 5.5 out of 10.