CVE-2026-82288: Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-28 · updated 2026-09-24
Weakness: CWE-522

Description

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

Affected products

AUTOMATIC1111 stable-diffusion-webui: through 1.10.1

References

https://github.com/AUTOMATIC1111/stable-diffusion-webui
https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411
https://www.vulncheck.com/advisories/stable-diffusion-webui-credential-disclosure-via-sdapi-v1-cmd-flags
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411

Get alerted when CVE-2026-82288 or the next vulnerability affects your stack