Login Request a demo
High severity · published Aug 28, 2026
CVE-2026-82288
Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
ST
stable-diffusion-webui · AUTOMATIC1111
through 1.10.1 · source: vendor
Affected product
ST
stable-diffusion-webui
AUTOMATIC1111
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-82288
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-82288
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py
github.com
https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411
www.vulncheck.com
https://www.vulncheck.com/advisories/stable-diffusion-webui-credential-disclosure-via-sdapi-v1-cmd-flags
More from stable-diffusion-webui
9.6
CVE-2024-11045
Cross-Site WebSocket Hijacking (CSWSH) in automatic1111/stable-diffusion-webui
7.5
CVE-2024-10935
Unauthenticated DoS via Multipart Boundary in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12074
Denial of Service in automatic1111/stable-diffusion-webui
6.5
CVE-2024-12375
Local File Inclusion in automatic1111/stable-diffusion-webui
6.3
CVE-2026-111986
AUTOMATIC1111 stable-diffusion-webui Model Instantiation sd_models.py get_obj_from_str code injection