Vulnerability Description
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/AUTOMATIC1111/stable-diffusion-webui
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411
- https://www.vulncheck.com/advisories/stable-diffusion-webui-credential-disclosur
- https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411
FAQ
What is CVE-2026-82288?
CVE-2026-82288 is a vulnerability with a CVSS score of 7.5 (HIGH). Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth v...
How severe is CVE-2026-82288?
CVE-2026-82288 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-82288?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.