CVE-2026-82288

CVE-2026-82288 is a credential disclosure vulnerability in Stable Diffusion WebUI through version 1.10.1 in which the /sdapi/v1/cmd-flags API endpoint returns parsed command-line arguments, including gradio_auth and api_auth values, in cleartext. An unauthenticated attacker who can reach the endpoint can send a request to it and read the configured usernames and passwords directly from the response. Using those harvested credentials, the attacker can then authenticate to the interface and gain access to the application, producing a high confidentiality impact (CVSS 4.0 score 8.7). Any deployment running Stable Diffusion WebUI up to and including 1.10.1 that exposes the API and relies on gradio_auth or api_auth for access control is affected. No public proof-of-concept is known, the flaw is not in CISA KEV, and EPSS assigns a 0.3% probability of exploitation within 30 days, indicating no confirmed exploitation at this time.

What to do: Upgrade Stable Diffusion WebUI to a release newer than 1.10.1 once a patched version is available. Until then, restrict network access to the /sdapi/v1 endpoints (bind to localhost or place behind a reverse proxy/firewall), rotate any credentials currently supplied via --gradio-auth or --api-auth after patching, and check your deployment for exposed cmd-flags access to confirm whether credentials were retrievable.