Executive brief
browser-use web-ui is a browser-based AI agent interface that stores configured language model provider API keys (such as OpenAI, Anthropic, etc.) in plaintext JSON files on disk. Attackers with local access to the system can read these files and recover the API keys, allowing them to make unauthorized API calls, incur costs, or access sensitive data processed through the LLM.
Technical details
The vulnerability is an insecure storage issue in the WebuiManager component. The save_config() method writes all UI component values—including LLM API keys—to JSON files in a predictable directory (./tmp/webui_settings/). No encryption is applied to the stored credentials, and the files are created with default permissions that may be readable by other local users. An attacker with local file system access (via compromised account, container escape, or host compromise) can trivially recover plaintext API keys. The affected versions are 2.0.0 through 3.0.0. The attack vector is local; no network access is required.
Affected products
- browser-use web-ui 2.0.0 through 3.0.0
Timeline
- 2026-08-30: disclosed