Credential Disclosure in Stable Diffusion WebUI by AUTOMATIC1111

CVE-2026-82288

What is CVE-2026-82288?

The Stable Diffusion WebUI through version 1.10.1 is susceptible to a credential disclosure vulnerability located at the /sdapi/v1/cmd-flags endpoint. This endpoint inadvertently exposes sensitive command-line arguments, including gradio_auth and api_auth values, in cleartext format. As a result, unauthorized attackers who can access the endpoint may retrieve stored usernames and passwords, subsequently enabling them to authenticate and gain unauthorized access to the interface and the application itself.

References