High severity7.5NVD Advisory· Published Aug 28, 2026· Updated Sep 24, 2026
CVE-2026-82288
CVE-2026-82288
Description
Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio_auth and api_auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured usernames and passwords, then use them to authenticate to the interface and access the application.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2(expand)+ 1 more
- (no CPE)
- (no CPE)range: <=1.10.1
Patches
Vulnerability mechanics
References
3News mentions
0No linked articles in our index yet.