CVE-2026-82288: Stable Diffusion WebUI Credential Disclosure via /sdapi/v1/cmd-flags
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradioauth and apiauth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Stable Diffusion WebUI installations through version 1.10.1 are affected when the /sdapi/v1/cmd-flags endpoint is reachable by an unauthenticated attacker. The endpoint discloses configured gradio_auth and api_auth values in cleartext.
What does an attacker need to exploit this issue?
An attacker needs only network access to the exposed /sdapi/v1/cmd-flags endpoint. No prior authentication, privileges, or user interaction are required.
What is the practical impact if credentials are configured?
An attacker can retrieve the configured usernames and passwords and use them to authenticate to the WebUI interface. This provides access to the application using the disclosed credentials.