browser-use web-ui CVE-2026-82637

Exploitation requires network access to the Gradio web interface of browser-use web-ui, typically served on port 7860/tcp. No authentication is required - the Gradio interface is unauthenticated by default, confirmed by PR:N in the CVSS 4.0 vector. The container must be running as root (the documented default deployment posture) for the broadest impact; non-root container deployments limit exploitable write targets but do not eliminate the path injection primitive entirely. No prior session state, browser interaction, or special protocol knowledge is required - a single crafted HTTP POST to the agent task endpoint is sufficient. Exploitation impact is bounded to directory creation (not arbitrary file write or read), so chained impact depends on whether the attacker can leverage created directory paths in privileged contexts (e.g., cron drop-ins, sudoers fragments, or dynamic-library search paths). Deployments exposing the Gradio interface to untrusted or internet-facing networks are the highest-risk population.

The CVSS 4.0 score of 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N reflects low-complexity, unauthenticated, network-reachable exploitation with a low integrity-only impact - a reasonable characterization of the isolated primitive (directory creation, not arbitrary file write). EPSS data is absent from the input, preventing exploitation-probability quantification. The vulnerability is not in CISA KEV and no public exploit has been identified at time of analysis. Despite the moderate score, real-world risk is amplified by two compounding factors: the Gradio interface has no authentication by default (confirmed PR:N), and the container's root execution context means an attacker can create directories in sensitive locations - such as /etc/cron.d, /etc/sudoers.d, or /usr/local/bin - that could serve as stepping stones to persistence or privilege escalation beyond what VI:L alone implies. This is not a high-severity exploit primitive in isolation, but the zero-auth network exposure combined with root-context execution warrants prompt patching rather than reliance on compensating controls alone.

An attacker with network access to the exposed Gradio interface sends a crafted request to the run_agent_task endpoint, supplying an absolute path such as /etc/cron.d/implant as the value of save_recording_path. The server creates the directory without path validation because it executes as root within the container. In environments where the container filesystem is bind-mounted to the host, this primitive could be chained to plant directories in host-sensitive locations, enabling persistence or privilege escalation.