CVE-2026-82288
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
Risk Assessment
The risk includes unauthorized access to the application and data, which could lead to confidentiality and integrity breaches.
Recommendation
Upgrade Stable Diffusion WebUI to a patched version and restrict access to the /sdapi/v1/cmd-flags endpoint.
Other vulnerabilities in Stable Diffusion WebUI
See all- CVE-2026-77815High
to_abs_path in scripts/iib/tool.py normalizes the path with os.path.normpath, which does not resolve symbolic links. A symlink placed inside a scanned directory can point outside that directory, and FileResponse follows the link, disclosing files such as /etc/passwd.
- CVE-2026-77814High
is_path_trusted in scripts/iib/api.py compares the requested path against allowed parent directories with path.startswith(parent_path), without appending a path separator. A directory whose name merely begins with an allowed path satisfies the comparison, allowing access to files outside the allowed directory.
Original NVD description (English source)
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.