Vulnerability · Published Aug 28, 2026 · Assigned by VulnCheck

CVE-2026-82288Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags

High 7.5

In plain English

A high-severity security flaw in stable-diffusion-webui from AUTOMATIC1111. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.4%top 64.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.

Affected products (as reported)

Vendor	Product	Versions
AUTOMATIC1111	stable-diffusion-webui	0 – through 1.10.1

Weakness: CWE-522 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

GitHub Issue #17411 issue-tracking
https://github.com/AUTOMATIC1111/stable-diffusion-webui product
Vulnerable code: api.py technical-description
VulnCheck Advisory: Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags third-party-advisory