---
id: CVE-2026-82288
title: >-
  Stable Diffusion WebUI through 1.10.1 contains a credential disclosure
  vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed
  command-line arguments including gradio_auth and api_auth values in cleartext
summary: >-
  Stable Diffusion WebUI through 1.10.1 contains a credential disclosure
  vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed
  command-line arguments including gradio_auth and api_auth values in cleartext.
  Unauthenticated a…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
cwe:
  - CWE-522
vendor: AUTOMATIC1111
product: stable-diffusion-webui
affected:
  - stable-diffusion-webui <= 1.10.1
published: '2026-08-28'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:28:01.780'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-82288'
references:
  - url: 'https://github.com/AUTOMATIC1111/stable-diffusion-webui'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/AUTOMATIC1111/stable-diffusion-webui/blob/82a973c04367123ae98bd9abdf80d9eda9b910e2/modules/api/api.py
    label: disclosure@vulncheck.com
  - url: 'https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/stable-diffusion-webui-credential-disclosure-via-sdapi-v1-cmd-flags
    label: disclosure@vulncheck.com
  - url: 'https://github.com/AUTOMATIC1111/stable-diffusion-webui/issues/17411'
    label: 134c704f-9b21-4f2e-91b3-4a467353bcc0
tags:
  - nvd
  - cve.org
  - exploit-available
epss: 0.00414
epssPercentile: 0.33056
exploitAvailable: true
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-08-28T20:22:20.948090Z'
ingestedAt: '2026-09-24T15:45:56.692Z'
---

## Overview

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.